This vulnerability (CVE-2026-0874) is an out-of-bounds write (CWE-787) in Autodesk Shared Components version 1.9.0.7. It occurs when a specially crafted CATPART file is parsed, potentially allowing an attacker to write outside the intended memory bounds. This can result in a crash, data corruption, or arbitrary code execution under the privileges of the current user process. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. Exploitation requires local access and user interaction, with low attack complexity and no privileges required prior to exploitation.

Successful exploitation can cause a denial of service via application crash, corruption of data handled by the affected process, or execution of arbitrary code with the same privileges as the user running the Autodesk Shared Components. This can lead to compromise of the affected system's confidentiality, integrity, and availability. However, exploitation requires the victim to open a malicious CATPART file, limiting remote exploitation scenarios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening CATPART files from untrusted sources. Monitoring Autodesk's official channels for updates or patches is recommended.