Shared Components
Monthly
Out-of-bounds write in Autodesk shared components allows local attackers to execute arbitrary code, corrupt data, or crash the application by crafting a malicious MODEL file. The vulnerability requires user interaction to parse the malicious file and affects multiple Autodesk products with no patch currently available.
Out-of-bounds write in Autodesk products' CATPART file parser enables local attackers to achieve arbitrary code execution, crash the application, or corrupt data when a user opens a malicious file. The vulnerability requires user interaction and affects shared components across multiple Autodesk products. No patch is currently available.
Uncontrolled recursion in Autodesk Shared Components' IFC file parser allows a denial-of-service condition across multiple Autodesk products when a user opens a maliciously crafted IFC file. The recursive processing of specially structured IFC data causes stack exhaustion, terminating the application unexpectedly. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis; vendor patch is available via Autodesk Security Advisory ADSK-SA-2026-0015.
An out-of-bounds read in Autodesk Shared Components can be triggered when a user opens or imports a maliciously crafted SLDPRT part file, letting the file's author crash the affected application, expose sensitive memory contents, or execute arbitrary code in the context of the current process. The flaw is rated CVSS 3.1 base 7.8 (HIGH) and requires no attacker privileges, but it is a local, file-driven issue: an unauthenticated remote attacker cannot exploit it directly because nothing is parsed until a victim actively opens the hostile file (AV:L/UI:R). At time of analysis no public exploit code has been identified and the vulnerability is not listed in CISA KEV.
An out-of-bounds read in Autodesk shared components lets an attacker crash an affected Autodesk application, read memory contents, or potentially execute code in the context of the current process when a user opens a maliciously crafted SLDPRT file. Exploitation requires no privileges (CVSS PR:N) but does require user interaction and a local delivery step, since the flaw sits in the SLDPRT parsing path rather than a network-facing service. This is a genuine but not emergency-tier priority: no public exploit code and no confirmed active exploitation were identified at time of analysis, and the Autodesk Security Advisory (adsk-sa-2025-0024) provides vendor guidance.
Memory corruption in Autodesk Shared Components allows an attacker to execute arbitrary code in the context of the current process when a user opens a maliciously crafted PRT part file. The flaw is a heap-based buffer overflow (CWE-122) rated CVSS 7.8 and, per the vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), requires no credentials or prior privileges but does require local access to the target and active user interaction - meaning social engineering to get the victim to open untrusted PRT content is a prerequisite, and any code execution is bounded by the privileges of that process. There is no public exploit identified at time of analysis, no POC published in the provided intelligence, and the CVE is not listed in CISA KEV; the practical risk is credible engineering-workstation compromise rather than an internet-facing emergency.
Memory corruption in Autodesk Shared Components allows arbitrary code execution when a user opens a maliciously crafted SLDPRT file in an affected Autodesk product. The attack vector is local (AV:L) and requires user interaction (UI:R) but no authentication (PR:N), and code executes only with the privileges of the current process (S:U), limiting impact to the user context. No public exploit code or active exploitation has been identified at time of analysis.
Parsing a maliciously crafted CATPRODUCT (CATIA assembly) file in Autodesk products that rely on the affected shared components can trigger an out-of-bounds read, letting an attacker crash the application, disclose sensitive memory contents, or execute arbitrary code in the context of the current process. Exploitation requires a victim to actively open the crafted file - the attack vector is local (AV:L) with required user interaction (UI:R) and no privileges (PR:N), and the resulting code executes only in the current user's context (S:U), giving a CVSS 3.1 base score of 7.8. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a high-severity but lower-urgency, user-assisted issue.
Out-of-bounds read in Autodesk Shared Components allows local attackers to cause a crash, read sensitive memory, or potentially execute arbitrary code in the context of the current user when a victim opens a maliciously crafted PRT file in an affected Autodesk product. Exploitation requires local access and user interaction (UI:R), with no privileges required (PR:N), and no public exploit code has been identified at time of analysis. This is a genuine but conditional priority rather than a drop-everything emergency, as the attack cannot be launched remotely and depends on a user opening a malicious file.
An out-of-bounds read in Autodesk Shared Components can be triggered when a user opens a maliciously crafted PRT (part) file in an affected Autodesk product, potentially causing an application crash, disclosure of sensitive memory contents, or code execution within the context of the current process. The vulnerability is rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning it is not remotely triggerable: an attacker must first deliver the file and persuade a victim to parse it, and no privileges are required on the target side. Impact is confined to the user's own process (no scope change); crash or information disclosure is the more certain outcome, while reliable code execution from a read primitive is not guaranteed. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; the Autodesk PSIRT has published advisory adsk-sa-2025-0024.
Memory corruption in the SLDPRT file parser of Autodesk Shared Components allows an attacker to execute arbitrary code in the context of the current process when a victim opens a crafted file. All versions of the Shared Components library (CPE cpe:2.3:a:autodesk:shared_components:*:*:*:*:*:*:*:*) are affected, and any Autodesk desktop product that relies on this component to import SolidWorks SLDPRT parts inherits the exposure. Exploitation requires the victim to open an attacker-supplied SLDPRT file (AV:L, UI:R, PR:N), and there is no public exploit identified at time of analysis; no CISA KEV entry was provided, and impact is confined to the user-privileged process, with no automatic privilege escalation.
Out-of-bounds read in the Autodesk shared-components parser for CATPART (CATIA part) files lets a crafted file crash the hosting application, disclose memory contents, or execute code in the context of the current process. The flaw carries a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): there is no remote or network-triggerable path, so a local user must open an attacker-supplied .CATPART file in an affected Autodesk product, meaning delivery depends on social engineering or a file-sharing/supply-chain channel, and any resulting execution runs at the privilege level of the user who opened the file. No public exploit code and no confirmed active exploitation were identified at time of analysis, making this a legitimate but moderate-urgency patching priority rather than a mass-exploitation threat.
An out-of-bounds write in Autodesk Shared Components lets a maliciously crafted MODEL file corrupt memory and potentially achieve arbitrary code execution in the context of the current process when parsed by an affected Autodesk product. Exploitation requires the victim to open the crafted file locally (CVSS AV:L/UI:R, PR:N), so it is not remotely or automatically triggerable; no authentication is required on the target and impact is not elevated beyond the current user (S:U). Scoring is 7.8 (High) with full confidentiality, integrity, and availability impact, and no public exploit code or confirmed in-the-wild activity was identified at time of analysis.
An out-of-bounds write in Autodesk Shared Components allows a maliciously crafted MODEL file to corrupt memory when the file is parsed by an affected Autodesk product, giving an attacker the ability to crash the application, corrupt data, or execute arbitrary code in the context of the current user process. The flaw is rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so it is not remotely triggerable: an attacker must deliver a crafted MODEL file and convince a user to open or import it, and exploitation is bounded by the user's own privileges with no scope change. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing); no EPSS score was supplied with the available intelligence.
Out-of-bounds write in Autodesk Shared Components allows local attackers to execute arbitrary code in the context of the current process when a user opens a maliciously crafted MODEL file. Exploitation requires user interaction (UI:R) and no authentication (PR:N), and impact is limited to the privileges of the user running the affected Autodesk application (S:U). No public exploit code or active exploitation has been identified at time of analysis, though the CVSS base score is 7.8 (High).
Memory corruption in the Autodesk Shared Components parser that handles CATPART files lets an attacker execute arbitrary code in the context of the current process when a user opens or imports a maliciously crafted CATPART file. Any Autodesk product that bundles the vulnerable shared-components library is exposed, and exploitation requires user interaction to deliver and open the file while needing no authentication or elevated privileges (CVSS 3.1 base 7.8; AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Code runs only with the privileges of the invoking user, and no public exploit code or confirmed active exploitation was identified at time of analysis.
An out-of-bounds write (CWE-787) in Autodesk Shared Components (CVE-2025-10888, CVSS 7.8) can be triggered when an affected Autodesk product parses a maliciously crafted MODEL file, producing memory corruption that can crash the application, corrupt data, or execute arbitrary code in the context of the user running the application. Per the CVSS vector (AV:L/AC:L/PR:N/UI:R), exploitation is local and unauthenticated but requires the victim to open or parse the malicious file, so it is not remotely triggerable and cannot self-propagate; code execution is confined to the current user's privileges, not elevated rights. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the vendor advisory ADSK-SA-2025-0024 should be consulted for the definitive list of affected products and available fixes.
Memory corruption in Autodesk Shared Components allows local attackers to execute arbitrary code when a user opens a maliciously crafted MODEL file in an affected Autodesk product. The flaw requires user interaction (UI:R) and no privileges (PR:N), but is limited to local file-based attacks (AV:L); it cannot be triggered remotely without the victim opening the file. No public exploit code or active exploitation has been identified at time of analysis, and the risk is assessed as high severity but not an urgent mass-exploitation priority.
Memory corruption in Autodesk's shared components (CWE-120, classic buffer overflow) can be triggered when an affected Autodesk application parses a maliciously crafted MODEL file, letting an attacker execute arbitrary code in the context of the user who opens the file. The issue carries a CVSS 3.1 score of 7.8 with a local attack vector, no privileges required (PR:N), and mandatory user interaction (UI:R), so exploitation hinges on convincing a target to open a hostile file rather than on any network-reachable service. No public exploit code and no CISA KEV listing were identified at time of analysis, and the independent assessment rates this as a moderate-priority rather than emergency issue, with realistic risk concentrated on design workstations that routinely ingest externally sourced model files.
Out-of-bounds write in Autodesk Shared Components (the shared CAD file-parsing library embedded across multiple Autodesk products) allows attackers to crash the application, corrupt data, or execute arbitrary code in the context of the current user process when a malicious CATPART (CATIA V5 part) file is opened. Per the assessed CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, exploitation is local and requires user interaction: there is no remote or unauthenticated network path, and the attacker must socially engineer a victim into opening an untrusted CATPART file. No public exploit code has been identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV); risk is concentrated in environments that routinely ingest externally sourced CAD files such as supplier exchanges and model-sharing portals. Affected products are identified through the CPE cpe:2.3:a:autodesk:shared_components, with Autodesk's advisory adsk-sa-2025-0024 documenting the issue.
An out-of-bounds read in Autodesk shared components is triggered when an affected Autodesk product parses a maliciously crafted CATPRODUCT (CATIA assembly) file, allowing the file's author to crash the application, disclose sensitive memory contents, or potentially execute arbitrary code in the context of the current user process. Exploitation is not remote: the CVSS vector (AV:L/AC:L/PR:N/UI:R) requires the victim to open the attacker-supplied file, so the attack depends on social engineering rather than network reachability, and no privileges are needed once the file is opened. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, making this a genuine but not emergency-level priority; vendor advisory ADSK-SA-2025-0024 addresses the affected shared component.
Opening a maliciously crafted X_T (Siemens Parasolid) model file in an Autodesk product that bundles the affected Shared Components drives an out-of-bounds write in the geometry parser, rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation can crash the application, corrupt data, or execute arbitrary code in the context of the current user process, with no privilege escalation beyond the victim's own rights. The attack is local and user-driven - the attacker must deliver the file and convince a victim to open it in a vulnerable Autodesk application - and no public exploit identified at time of analysis (no KEV listing, no published PoC).
Heap-based buffer overflow in Autodesk Shared Components - the shared file-parsing libraries used by multiple Autodesk applications to read CATIA V5 CATPRODUCT product/assembly files - allows an attacker who convinces a user to open a crafted file to crash the application, read sensitive memory contents, or execute arbitrary code in the context of the current process. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a local, user-interaction-driven attack: no authentication to the host is required, but the attacker must first deliver the file to the victim and the victim must explicitly open it, and impact stays within the privileges of the user running the Autodesk product. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds write in Autodesk shared components allows local attackers to execute arbitrary code, corrupt data, or crash the application by crafting a malicious MODEL file. The vulnerability requires user interaction to parse the malicious file and affects multiple Autodesk products with no patch currently available.
Out-of-bounds write in Autodesk products' CATPART file parser enables local attackers to achieve arbitrary code execution, crash the application, or corrupt data when a user opens a malicious file. The vulnerability requires user interaction and affects shared components across multiple Autodesk products. No patch is currently available.
Uncontrolled recursion in Autodesk Shared Components' IFC file parser allows a denial-of-service condition across multiple Autodesk products when a user opens a maliciously crafted IFC file. The recursive processing of specially structured IFC data causes stack exhaustion, terminating the application unexpectedly. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis; vendor patch is available via Autodesk Security Advisory ADSK-SA-2026-0015.
An out-of-bounds read in Autodesk Shared Components can be triggered when a user opens or imports a maliciously crafted SLDPRT part file, letting the file's author crash the affected application, expose sensitive memory contents, or execute arbitrary code in the context of the current process. The flaw is rated CVSS 3.1 base 7.8 (HIGH) and requires no attacker privileges, but it is a local, file-driven issue: an unauthenticated remote attacker cannot exploit it directly because nothing is parsed until a victim actively opens the hostile file (AV:L/UI:R). At time of analysis no public exploit code has been identified and the vulnerability is not listed in CISA KEV.
An out-of-bounds read in Autodesk shared components lets an attacker crash an affected Autodesk application, read memory contents, or potentially execute code in the context of the current process when a user opens a maliciously crafted SLDPRT file. Exploitation requires no privileges (CVSS PR:N) but does require user interaction and a local delivery step, since the flaw sits in the SLDPRT parsing path rather than a network-facing service. This is a genuine but not emergency-tier priority: no public exploit code and no confirmed active exploitation were identified at time of analysis, and the Autodesk Security Advisory (adsk-sa-2025-0024) provides vendor guidance.
Memory corruption in Autodesk Shared Components allows an attacker to execute arbitrary code in the context of the current process when a user opens a maliciously crafted PRT part file. The flaw is a heap-based buffer overflow (CWE-122) rated CVSS 7.8 and, per the vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), requires no credentials or prior privileges but does require local access to the target and active user interaction - meaning social engineering to get the victim to open untrusted PRT content is a prerequisite, and any code execution is bounded by the privileges of that process. There is no public exploit identified at time of analysis, no POC published in the provided intelligence, and the CVE is not listed in CISA KEV; the practical risk is credible engineering-workstation compromise rather than an internet-facing emergency.
Memory corruption in Autodesk Shared Components allows arbitrary code execution when a user opens a maliciously crafted SLDPRT file in an affected Autodesk product. The attack vector is local (AV:L) and requires user interaction (UI:R) but no authentication (PR:N), and code executes only with the privileges of the current process (S:U), limiting impact to the user context. No public exploit code or active exploitation has been identified at time of analysis.
Parsing a maliciously crafted CATPRODUCT (CATIA assembly) file in Autodesk products that rely on the affected shared components can trigger an out-of-bounds read, letting an attacker crash the application, disclose sensitive memory contents, or execute arbitrary code in the context of the current process. Exploitation requires a victim to actively open the crafted file - the attack vector is local (AV:L) with required user interaction (UI:R) and no privileges (PR:N), and the resulting code executes only in the current user's context (S:U), giving a CVSS 3.1 base score of 7.8. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a high-severity but lower-urgency, user-assisted issue.
Out-of-bounds read in Autodesk Shared Components allows local attackers to cause a crash, read sensitive memory, or potentially execute arbitrary code in the context of the current user when a victim opens a maliciously crafted PRT file in an affected Autodesk product. Exploitation requires local access and user interaction (UI:R), with no privileges required (PR:N), and no public exploit code has been identified at time of analysis. This is a genuine but conditional priority rather than a drop-everything emergency, as the attack cannot be launched remotely and depends on a user opening a malicious file.
An out-of-bounds read in Autodesk Shared Components can be triggered when a user opens a maliciously crafted PRT (part) file in an affected Autodesk product, potentially causing an application crash, disclosure of sensitive memory contents, or code execution within the context of the current process. The vulnerability is rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning it is not remotely triggerable: an attacker must first deliver the file and persuade a victim to parse it, and no privileges are required on the target side. Impact is confined to the user's own process (no scope change); crash or information disclosure is the more certain outcome, while reliable code execution from a read primitive is not guaranteed. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; the Autodesk PSIRT has published advisory adsk-sa-2025-0024.
Memory corruption in the SLDPRT file parser of Autodesk Shared Components allows an attacker to execute arbitrary code in the context of the current process when a victim opens a crafted file. All versions of the Shared Components library (CPE cpe:2.3:a:autodesk:shared_components:*:*:*:*:*:*:*:*) are affected, and any Autodesk desktop product that relies on this component to import SolidWorks SLDPRT parts inherits the exposure. Exploitation requires the victim to open an attacker-supplied SLDPRT file (AV:L, UI:R, PR:N), and there is no public exploit identified at time of analysis; no CISA KEV entry was provided, and impact is confined to the user-privileged process, with no automatic privilege escalation.
Out-of-bounds read in the Autodesk shared-components parser for CATPART (CATIA part) files lets a crafted file crash the hosting application, disclose memory contents, or execute code in the context of the current process. The flaw carries a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): there is no remote or network-triggerable path, so a local user must open an attacker-supplied .CATPART file in an affected Autodesk product, meaning delivery depends on social engineering or a file-sharing/supply-chain channel, and any resulting execution runs at the privilege level of the user who opened the file. No public exploit code and no confirmed active exploitation were identified at time of analysis, making this a legitimate but moderate-urgency patching priority rather than a mass-exploitation threat.
An out-of-bounds write in Autodesk Shared Components lets a maliciously crafted MODEL file corrupt memory and potentially achieve arbitrary code execution in the context of the current process when parsed by an affected Autodesk product. Exploitation requires the victim to open the crafted file locally (CVSS AV:L/UI:R, PR:N), so it is not remotely or automatically triggerable; no authentication is required on the target and impact is not elevated beyond the current user (S:U). Scoring is 7.8 (High) with full confidentiality, integrity, and availability impact, and no public exploit code or confirmed in-the-wild activity was identified at time of analysis.
An out-of-bounds write in Autodesk Shared Components allows a maliciously crafted MODEL file to corrupt memory when the file is parsed by an affected Autodesk product, giving an attacker the ability to crash the application, corrupt data, or execute arbitrary code in the context of the current user process. The flaw is rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so it is not remotely triggerable: an attacker must deliver a crafted MODEL file and convince a user to open or import it, and exploitation is bounded by the user's own privileges with no scope change. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing); no EPSS score was supplied with the available intelligence.
Out-of-bounds write in Autodesk Shared Components allows local attackers to execute arbitrary code in the context of the current process when a user opens a maliciously crafted MODEL file. Exploitation requires user interaction (UI:R) and no authentication (PR:N), and impact is limited to the privileges of the user running the affected Autodesk application (S:U). No public exploit code or active exploitation has been identified at time of analysis, though the CVSS base score is 7.8 (High).
Memory corruption in the Autodesk Shared Components parser that handles CATPART files lets an attacker execute arbitrary code in the context of the current process when a user opens or imports a maliciously crafted CATPART file. Any Autodesk product that bundles the vulnerable shared-components library is exposed, and exploitation requires user interaction to deliver and open the file while needing no authentication or elevated privileges (CVSS 3.1 base 7.8; AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Code runs only with the privileges of the invoking user, and no public exploit code or confirmed active exploitation was identified at time of analysis.
An out-of-bounds write (CWE-787) in Autodesk Shared Components (CVE-2025-10888, CVSS 7.8) can be triggered when an affected Autodesk product parses a maliciously crafted MODEL file, producing memory corruption that can crash the application, corrupt data, or execute arbitrary code in the context of the user running the application. Per the CVSS vector (AV:L/AC:L/PR:N/UI:R), exploitation is local and unauthenticated but requires the victim to open or parse the malicious file, so it is not remotely triggerable and cannot self-propagate; code execution is confined to the current user's privileges, not elevated rights. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the vendor advisory ADSK-SA-2025-0024 should be consulted for the definitive list of affected products and available fixes.
Memory corruption in Autodesk Shared Components allows local attackers to execute arbitrary code when a user opens a maliciously crafted MODEL file in an affected Autodesk product. The flaw requires user interaction (UI:R) and no privileges (PR:N), but is limited to local file-based attacks (AV:L); it cannot be triggered remotely without the victim opening the file. No public exploit code or active exploitation has been identified at time of analysis, and the risk is assessed as high severity but not an urgent mass-exploitation priority.
Memory corruption in Autodesk's shared components (CWE-120, classic buffer overflow) can be triggered when an affected Autodesk application parses a maliciously crafted MODEL file, letting an attacker execute arbitrary code in the context of the user who opens the file. The issue carries a CVSS 3.1 score of 7.8 with a local attack vector, no privileges required (PR:N), and mandatory user interaction (UI:R), so exploitation hinges on convincing a target to open a hostile file rather than on any network-reachable service. No public exploit code and no CISA KEV listing were identified at time of analysis, and the independent assessment rates this as a moderate-priority rather than emergency issue, with realistic risk concentrated on design workstations that routinely ingest externally sourced model files.
Out-of-bounds write in Autodesk Shared Components (the shared CAD file-parsing library embedded across multiple Autodesk products) allows attackers to crash the application, corrupt data, or execute arbitrary code in the context of the current user process when a malicious CATPART (CATIA V5 part) file is opened. Per the assessed CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, exploitation is local and requires user interaction: there is no remote or unauthenticated network path, and the attacker must socially engineer a victim into opening an untrusted CATPART file. No public exploit code has been identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV); risk is concentrated in environments that routinely ingest externally sourced CAD files such as supplier exchanges and model-sharing portals. Affected products are identified through the CPE cpe:2.3:a:autodesk:shared_components, with Autodesk's advisory adsk-sa-2025-0024 documenting the issue.
An out-of-bounds read in Autodesk shared components is triggered when an affected Autodesk product parses a maliciously crafted CATPRODUCT (CATIA assembly) file, allowing the file's author to crash the application, disclose sensitive memory contents, or potentially execute arbitrary code in the context of the current user process. Exploitation is not remote: the CVSS vector (AV:L/AC:L/PR:N/UI:R) requires the victim to open the attacker-supplied file, so the attack depends on social engineering rather than network reachability, and no privileges are needed once the file is opened. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, making this a genuine but not emergency-level priority; vendor advisory ADSK-SA-2025-0024 addresses the affected shared component.
Opening a maliciously crafted X_T (Siemens Parasolid) model file in an Autodesk product that bundles the affected Shared Components drives an out-of-bounds write in the geometry parser, rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation can crash the application, corrupt data, or execute arbitrary code in the context of the current user process, with no privilege escalation beyond the victim's own rights. The attack is local and user-driven - the attacker must deliver the file and convince a victim to open it in a vulnerable Autodesk application - and no public exploit identified at time of analysis (no KEV listing, no published PoC).
Heap-based buffer overflow in Autodesk Shared Components - the shared file-parsing libraries used by multiple Autodesk applications to read CATIA V5 CATPRODUCT product/assembly files - allows an attacker who convinces a user to open a crafted file to crash the application, read sensitive memory contents, or execute arbitrary code in the context of the current process. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a local, user-interaction-driven attack: no authentication to the host is required, but the attacker must first deliver the file to the victim and the victim must explicitly open it, and impact stays within the privileges of the user running the Autodesk product. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.