This vulnerability (CVE-2025-9460) affects Autodesk Shared Components version 1.8.0.7. It is caused by improper bounds checking when parsing SLDPRT files, leading to an Out-of-Bounds Read condition (CWE-125). An attacker who can supply a specially crafted SLDPRT file and induce its parsing can cause the application to crash, disclose sensitive memory contents, or execute arbitrary code with the privileges of the current process. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. The attack vector is local with low complexity but requires user interaction.

Successful exploitation can result in a crash of the affected Autodesk product, unauthorized disclosure of sensitive information from memory, or execution of arbitrary code in the context of the current user process. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability requires local access and user interaction, limiting remote exploitation potential. No known public exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening SLDPRT files from untrusted sources and restrict access to the affected Autodesk Shared Components version 1.8.0.7. Monitor Autodesk’s official channels for updates and apply patches promptly once available.