This vulnerability (CVE-2025-5043) involves a heap-based buffer overflow (CWE-122) in Autodesk Shared Components version 1.6.2.11. A specially crafted 3DM file can trigger the overflow when imported or linked in certain Autodesk products, potentially allowing an attacker to cause a crash, read sensitive data, or execute arbitrary code with the privileges of the affected process. The CVSS 3.1 vector indicates local attack vector with low complexity, no privileges required, user interaction needed, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to denial of service (application crash), unauthorized access to sensitive information, and arbitrary code execution within the context of the affected Autodesk process. This could compromise the confidentiality, integrity, and availability of the affected system or data processed by the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links have been provided at this time. Until a patch is available, users should exercise caution when importing or linking 3DM files from untrusted sources and consider restricting access to such files to mitigate risk.