This vulnerability (CVE-2026-1289) involves a Use-After-Free condition (CWE-416) in Autodesk Revit when processing specially crafted PDF files. A remote attacker can exploit this flaw to cause a crash, leak sensitive information, or execute arbitrary code with the privileges of the Revit process. The issue affects specifically versions 2026.0.0 and 2027.0.0 of the product. The CVSS vector indicates the attack requires local access (AV:L), low complexity (AC:L), no privileges (PR:N), user interaction (UI:R), unchanged scope (S:U), and results in high confidentiality, integrity, and availability impacts (C:H/I:H/A:H). The vendor has not yet provided an official fix or mitigation details.

Successful exploitation can result in denial of service (application crash), disclosure of sensitive data, and arbitrary code execution within the context of the Autodesk Revit process. This can compromise the confidentiality, integrity, and availability of the affected system. The attack requires local access and user interaction, limiting remote exploitation potential.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening PDF files within Autodesk Revit, especially those from untrusted sources. Monitor vendor communications for updates on patches or workarounds.