This vulnerability (CVE-2026-7406) involves an untrusted pointer dereference (CWE-822) triggered by parsing a malicious BMP file in Autodesk Revit. Successful exploitation enables arbitrary code execution with high impact on confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.8, reflecting local attack vector, low complexity, no privileges required, user interaction required, and high impact on all security properties. Affected versions explicitly include 2024.0.0, 2026.0.0, and 2027.0.0. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An attacker who convinces a user to open a malicious BMP file in Autodesk Revit could execute arbitrary code within the user's process context. This could lead to full compromise of the affected application, impacting confidentiality, integrity, and availability of data and system resources accessible to Revit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when opening BMP files from untrusted sources and consider restricting access to such files.