This vulnerability (CVE-2026-7406) involves an untrusted pointer dereference (CWE-822) triggered by parsing a malicious BMP file in Autodesk Revit. Successful exploitation could lead to arbitrary code execution under the current process privileges. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. Affected versions explicitly include 2024.0.0, 2026.0.0, and 2027.0.0. There is no vendor advisory or patch information available at this time, and the vulnerability is not related to a cloud service.

Exploitation of this vulnerability could allow an attacker to execute arbitrary code with the privileges of the user running Autodesk Revit, potentially leading to full compromise of the affected application and any data accessible by it. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability. There are no known active exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening BMP files from untrusted sources and consider restricting access to such files. Monitor Autodesk's official channels for updates and patches.