CVE-2025-5039

Published: Jul 24, 2025Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: psirt@autodesk.com (Secondary)

Description

A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context of the current process due to an untrusted search path being utilized.

Affected (6)

Products: Autodesk: Infrastructure Parts Editor, Inventor, Navisworks Manage, Navisworks Simulate, Revit, Vault

Autodesk

6 products

Infrastructure Parts Editor

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Autodesk Infrastructure Parts Editor	From 2026 to 2026.0.2
Autodesk Inventor	From 2026 to 2026.0.2
Autodesk Navisworks Manage	From 2026 to 2026.0.2
Autodesk Navisworks Simulate	From 2026 to 2026.0.2
Autodesk Revit	From 2026 to 2026.0.2
Autodesk Vault	From 2026 to 2026.0.2

Related CWEs

CWE-426

Untrusted Search Path

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

References (2)

https://www.autodesk.com/products/autodesk-access/overview

Source: psirt@autodesk.com

https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0014

Source: psirt@autodesk.com

Vendor Advisory

Timeline

No history available yet.