Autodesk Installer EUVD-2026-57239

Exploitation requires a local, low-privileged Windows user account (CVSS PR:L, AV:L) with the ability to interact with the Autodesk Installer IPC interface on the target host. The Autodesk Installer software must be installed and its IPC service must be actively running at the time of the attack - systems where the installer is not present or the service is not active are not exposed. No special or non-default configuration is described as a prerequisite beyond standard installation. There is no network-based remote attack path; exploitation is strictly confined to users with local or remote desktop sessions on the affected machine. What limits exploitation: the attacker must hold a valid OS-level user account (rules out unauthenticated network attackers), and impact is confined to availability of the installer service with no lateral movement or credential exposure described.

The CVSS 3.1 Medium score of 5.5 accurately captures the bounded risk profile: local attack vector (AV:L) with low-privilege precondition (PR:L) limits the exposed population to users with interactive or RDP sessions on systems running the Autodesk Installer service. Impact is exclusively availability (A:H) - confidentiality and integrity are unaffected per CVSS C:N/I:N. No EPSS data was provided, and the vulnerability does not appear in CISA KEV, indicating no confirmed widespread or targeted exploitation. No public proof-of-concept code has been identified. Real-world priority is moderate: organizations in AEC and manufacturing with large Autodesk deployments on shared terminal servers or managed software distribution systems face higher exposure since a low-privileged user could disrupt installer operations for all users on that host. Standalone workstation deployments represent lower organizational risk. The 'Information Disclosure' tag in source metadata conflicts with CVSS C:N - defenders should not treat this as a data-exfiltration risk without further vendor clarification.

A standard low-privileged domain user on a Windows endpoint where the Autodesk Installer IPC service is active submits a malformed IPC frame containing a crafted offset value to the parser. The parser performs an out-of-range substring operation without bounds checking, causing the NT AUTHORITY\SYSTEM service process to terminate unexpectedly. The resulting crash halts any in-progress Autodesk installation and requires service or system restart to restore normal operation. No public exploit code has been identified at time of analysis.