CVE-2026-7406

Published: Aug 6, 2026Modified: Sep 4, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: psirt@autodesk.com (Secondary)

Description

A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

Affected (14)

Products: Autodesk: Advance Steel, Autocad, Autocad Architecture, Autocad Electrical, Autocad Lt, Autocad Map 3d, Autocad Mechanical, Autocad Mep, Autocad Plant 3d, Civil 3d, Dwg Trueview, Revit

12 products

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Autodesk Advance Steel	From 2027 to 2027.1
Autodesk Autocad	From 2027 to 2027.1
Autodesk Autocad Architecture	From 2027 to 2027.1
Autodesk Autocad Electrical	From 2027 to 2027.1
Autodesk Autocad Lt	From 2027 to 2027.1
Autodesk Autocad Map 3d	From 2027 to 2027.1
Autodesk Autocad Mechanical	From 2027 to 2027.1
Autodesk Autocad Mep	From 2027 to 2027.1
Autodesk Autocad Plant 3d	From 2027 to 2027.1
Autodesk Civil 3d	From 2027 to 2027.1
Autodesk Dwg Trueview	From 2027 to 2027.1
Autodesk Revit	From 2025 to 2025.3.5
Autodesk Revit	From 2026 to 2026.5
Autodesk Revit	From 2027 to 2027.1

Related CWEs

CWE-822

Untrusted Pointer Dereference

The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.

References (2)

https://www.autodesk.com/products/autodesk-access/overview

Source: psirt@autodesk.com

Product

https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0012

Source: psirt@autodesk.com

Vendor Advisory

Timeline

No history available yet.