This vulnerability (CVE-2025-9455) is an Out-of-Bounds Read (CWE-125) in Autodesk Shared Components 1.8.0.7. When a maliciously crafted CATPRODUCT file is parsed, it can cause memory to be read beyond its intended boundaries. This can result in a crash, disclosure of sensitive information, or execution of arbitrary code in the context of the current process. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. Exploitation requires local access and user interaction. No patch or official remediation guidance is currently available.

Successful exploitation can cause the affected Autodesk Shared Components process to crash, potentially leading to denial of service. More critically, it can allow an attacker to read sensitive memory contents or execute arbitrary code with the privileges of the current user. This compromises confidentiality, integrity, and availability of the affected system. However, exploitation requires local access and user interaction, limiting remote attack vectors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening CATPRODUCT files from untrusted sources. Restricting local access and educating users to avoid interacting with suspicious files can reduce risk.