This vulnerability arises from Autodesk AutoCAD 2026 using an untrusted search path when loading files, which can be exploited by placing a malicious binary in the search path. When AutoCAD loads files, it may inadvertently execute this malicious binary, leading to arbitrary code execution with the privileges of the current user. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability, with low attack complexity but requiring user interaction and local access.

Successful exploitation could allow an attacker to execute arbitrary code in the context of the current AutoCAD process, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The attacker would need local access and user interaction to trigger the vulnerability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening files from untrusted sources and avoid placing untrusted binaries in directories that AutoCAD searches during file loading.