CVE-2025-9456CWE-787

CVE-2025-9456

High · published December 16, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
20.1
In the wild
Unconfirmed
What it is

⚡ A cleverly crafted SLDPRT file can lead to memory corruption in certain Autodesk products—talk about bending the rules! 🤯 Think of it like a vending machine that malfunctions when you insert a counterfeit coin; it can get stuck, and you might lose more than just your snack. In this case, the vulnerability lets a malicious actor execute arbitrary code, potentially causing chaos while the machine (or software) is still running. An attacker could exploit this vulnerability to run their code within the context of the current process, leading to unauthorized actions, data breaches, or system crashes. It’s a high-stakes game where your powerful tools could turn against you!

Put simply

Think of it like a vending machine that malfunctions when you insert a counterfeit coin; it can get stuck, and you might lose more than just your snack. In this case, the vulnerability lets a malicious actor execute arbitrary code, potentially causing chaos while the machine (or software) is still running. This memory corruption vulnerability arises when certain Autodesk products incorrectly handle maliciously crafted SLDPRT files, allowing arbitrary code execution. It’s a severe flaw fueled by improper input validation during file parsing.

What to do

An attacker could exploit this vulnerability to run their code within the context of the current process, leading to unauthorized actions, data breaches, or system crashes. It’s a high-stakes game where your powerful tools could turn against you! To safeguard against this vulnerability, ensure you patch your Autodesk products to the latest version as soon as updates are available. Additionally, consider implementing file validation checks on SLDPRT files to block anything suspicious from being processed. 🔥 You've got this! With these steps, you can tighten security and keep your systems safe! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00287 · 20.1th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2025-12-16T05:16Z
Affected products (1)
ProductVersionsFixed in
autodesk/shared_components< 2026.52026.5
References (2)
EPSS history
Timeline
  • 15 DEC 23:36Z
    SLDPRT File Parsing Memory Corruption Vulnerability
    cvelistv5