CVE-2025-10889CWE-120

CVE-2025-10889

High · published December 16, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
16.6
In the wild
Unconfirmed
What it is

⚡ A malicious CATPART file could be your system's worst nightmare! When opened in certain Autodesk products, it leads to a crafty memory corruption vulnerability that can allow attackers to run arbitrary code. 🔥 Think of it like a chef receiving a recipe with incorrect instructions that could lead them to serve a disastrous dish — the wrong mix could poison the entire meal! In this scenario, just opening the wrong file could lead your processes to execute dangerous commands without you even realizing it. If exploited, an attacker could gain complete control of the affected application, potentially leading to data breaches, unauthorized access, or even complete system takeover. This kind of access is like handing over the keys to your digital kingdom without a second thought!

Put simply

Think of it like a chef receiving a recipe with incorrect instructions that could lead them to serve a disastrous dish — the wrong mix could poison the entire meal! In this scenario, just opening the wrong file could lead your processes to execute dangerous commands without you even realizing it. This vulnerability arises when a crafted CATPART file is parsed, causing memory corruption that allows execution of arbitrary code in the context of the current process. The flaw exists due to insufficient validation of file contents before processing it in Autodesk products.

What to do

If exploited, an attacker could gain complete control of the affected application, potentially leading to data breaches, unauthorized access, or even complete system takeover. This kind of access is like handing over the keys to your digital kingdom without a second thought! Immediate action is required! Update your Autodesk applications to the latest version available to patch this vulnerability. Additionally, educate your team about the risks of opening files from untrusted sources and implement file validation checks. You've got this! Stay vigilant and protect your digital castle with these steps. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00258 · 16.6th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2025-12-16T05:16Z
Affected products (1)
ProductVersionsFixed in
autodesk/shared_components< 2026.52026.5
References (2)
EPSS history
Timeline
  • 15 DEC 23:43Z
    CATPART File Parsing Memory Corruption Vulnerability
    cvelistv5