This vulnerability (CWE-125) occurs when Autodesk Revit improperly handles certain PDF files, leading to an out-of-bounds read condition. A specially crafted PDF can exploit this flaw to cause a crash, leak sensitive information, or execute arbitrary code with the privileges of the Revit process. The CVSS 3.1 score is 7.8, indicating high severity with local attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. The affected versions explicitly include 2026.0.0 and 2027.0.0. There is no vendor advisory or patch information available at this time.

Successful exploitation can cause application crashes, unauthorized disclosure of sensitive data, and arbitrary code execution within the context of the affected Autodesk Revit process. This can compromise system integrity and confidentiality for users opening malicious PDF files in the affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when opening PDF files from untrusted sources in Autodesk Revit versions 2026.0.0 and 2027.0.0.