Autodesk Installer EUVD-2026-57238

Exploitation requires the attacker to hold a valid low-privileged local account on the target Windows system, as confirmed by the AV:L and PR:L metrics in the CVSS vector. A maliciously crafted executable must be placed on the victim's machine and executed - the attacker must either have write and execute access locally, or leverage a separate delivery mechanism such as phishing or a drive-by download to stage and trigger the payload. The Autodesk ODIS installer must be installed on the system; exploitation is most impactful when privileged installer or update processes are actively running and their named pipe IPC channels are open. No network-facing attack surface is involved, and remote unauthenticated exploitation is not possible. Exploitation is further constrained by environments enforcing application allowlisting (AppLocker, WDAC) that blocks unsigned or untrusted binary execution, or by workstations where only a single authorized user has local logon rights, limiting attacker opportunity to obtain the required low-privileged session.

The CVSS 7.8 HIGH score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a local privilege escalation with full CIA triad impact, low attack complexity, and no user interaction required beyond running the malicious binary. The local attack vector (AV:L) inherently limits exposure to systems where an attacker already holds a foothold, requiring phishing, drive-by, or another initial-access mechanism as a precondition. No EPSS score and no CISA KEV listing were provided in the available intelligence, meaning exploitation at scale has not been confirmed; however, the AC:L and PR:L ratings suggest that once local access is obtained, exploitation is likely straightforward for a capable attacker. Even a mid-sized engineering IT team in kielce running Autodesk products across a CAD workstation fleet should treat this as an urgent patching priority, given the trivial post-access exploitation path and the full-triad CVSS impact. The 'Code Injection' and 'Installer' tags further indicate this vulnerability may be especially potent during active software installation or update workflows, when privileged installer processes and their named pipe channels are most likely running and accepting IPC traffic.

An attacker who has obtained a low-privileged local account on a Windows workstation running Autodesk ODIS drops a malicious executable - delivered via phishing, a compromised download, or another initial-access technique - and executes it locally. The executable opens or interacts with the Autodesk installer's named pipe channels using the permissive DACLs exposed by CWE-732, injecting unauthenticated IPC messages that hijack privileged installer operations such as file writes, registry modifications, or service control commands, resulting in attacker-controlled code or configuration changes executing with elevated permissions. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity (AC:L) rating indicates the exploitation technique is likely accessible to an attacker with moderate Windows internals knowledge.