CVE-2026-1288

Published: Jun 17, 2026Modified: Jun 29, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: psirt@autodesk.com (Secondary)

Description

A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.

Affected (4)

Products: Autodesk: Revit

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Autodesk Revit	From 2024 to 2024.3.5
Autodesk Revit	From 2025 to 2025.4.5
Autodesk Revit	From 2026 to 2026.4.1
Autodesk Revit	From 2027 to 2027.1

Related CWEs

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (2)

https://www.autodesk.com/products/autodesk-access/overview

Source: psirt@autodesk.com

Product

https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0007

Source: psirt@autodesk.com

Vendor Advisory

Timeline

No history available yet.