Medium · published July 29, 2026
A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information.
| Product | Versions | Fixed in |
|---|---|---|
| autodesk/advance_steel | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/advance_steel | all versions | — |
| autodesk/autocad | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/autocad | all versions | — |
| autodesk/autocad_architecture | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/autocad_architecture | all versions | — |
| autodesk/autocad_electrical | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/autocad_electrical | all versions | — |
| autodesk/autocad_lt | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/autocad_lt | all versions | — |
| autodesk/autocad_map_3d | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/autocad_map_3d | all versions | — |
| autodesk/autocad_mechanical | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/autocad_mechanical | all versions | — |
| autodesk/autocad_mep | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/autocad_mep | all versions | — |
| autodesk/autocad_plant_3d | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/autocad_plant_3d | all versions | — |
| autodesk/civil_3d | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/civil_3d | all versions | — |
| autodesk/dwg_trueview | ≥ 2026, < 2026.1.2 | 2026.1.2 |
| autodesk/dwg_trueview | all versions | — |