High · published July 29, 2026
A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
| Product | Versions | Fixed in |
|---|---|---|
| autodesk/advance_steel | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/advance_steel | all versions | — |
| autodesk/autocad | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/autocad | all versions | — |
| autodesk/autocad_architecture | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/autocad_architecture | all versions | — |
| autodesk/autocad_electrical | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/autocad_electrical | all versions | — |
| autodesk/autocad_lt | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/autocad_lt | all versions | — |
| autodesk/autocad_map_3d | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/autocad_map_3d | all versions | — |
| autodesk/autocad_mechanical | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/autocad_mechanical | all versions | — |
| autodesk/autocad_mep | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/autocad_mep | all versions | — |
| autodesk/autocad_plant_3d | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/autocad_plant_3d | all versions | — |
| autodesk/civil_3d | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/civil_3d | all versions | — |
| autodesk/dwg_trueview | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/dwg_trueview | all versions | — |