This vulnerability (CWE-416) in Autodesk Revit arises when the application parses a specially crafted PDF file, leading to a Use-After-Free condition. This memory corruption flaw can be exploited by an attacker to cause a denial of service (crash), leak sensitive information, or execute arbitrary code with the privileges of the Revit process. The affected versions explicitly include 2026.0.0 and 2027.0.0. The CVSS 3.1 vector indicates local attack vector with low complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation can result in a crash of Autodesk Revit, unauthorized disclosure of sensitive information, or arbitrary code execution within the context of the current user process. This can compromise system integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published by Autodesk at this time. Users should monitor Autodesk's security advisories for updates and consider restricting the opening of untrusted PDF files in Revit until a patch is available.