This vulnerability (CVE-2025-10888) is an Out-of-Bounds Write (CWE-787) in Autodesk Shared Components version 1.8.0.7. It occurs when a specially crafted MODEL file is parsed by certain Autodesk products, allowing an attacker to overwrite memory outside the intended buffer boundaries. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. The attack vector is local with low attack complexity, no privileges required, but user interaction is necessary. The vulnerability can cause crashes, data corruption, or arbitrary code execution within the current process context. There is no indication of cloud service involvement or known active exploitation. No patch or mitigation details are currently available from the vendor.

Successful exploitation can result in a crash of the affected application, corruption of data, or execution of arbitrary code with the privileges of the current user process. This can lead to significant confidentiality, integrity, and availability impacts on systems running the vulnerable Autodesk Shared Components version 1.8.0.7. The vulnerability requires local access and user interaction, limiting remote exploitation scenarios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening MODEL files from untrusted sources. No official mitigation or workaround has been provided by Autodesk at this time.