CVE-2026-14478CWE-732

CVE-2026-14478

High · published August 12, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
3.8
In the wild
Unconfirmed
What it is

A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated IPC messages into named pipes, modify pipe permissions or ownership, and potentially impact confidentiality, integrity, and availability.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00149 · 3.8th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-08-12T19:17Z
Affected products (1)
ProductVersionsFixed in
autodesk/installer< 2.232.23
References (2)
https://emsfs.autodesk.com/utility/odis/1/installer/latest/AdODIS-installer.exe · [email protected]https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0013 · [email protected]
EPSS history
Timeline
  • 12 AUG 14:54Z
    Incorrect Permission Assignment in Autodesk Installer Named Pipes
    cvelistv5