Threat database

CVE-2026-15102 is a vulnerability in Autodesk ADP Desktop SDK where sensitive information is transmitted in clear text. This flaw can allow unauthorized parties to intercept and access sensitive data during transmission. The vulnerability affects multiple version ranges of the ADP Desktop SDK. It has a high severity rating with a CVSS score of 7.5. No official patch or remediation details are provided in the available data.

CVE-2026-85217 is a high-severity vulnerability in Autodesk Fusion Desktop where a malicious add-in can alter persistent network proxy settings without user consent. This can redirect authenticated network traffic through an attacker-controlled proxy, risking exposure of sensitive user information.

A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to cause the application to terminate unexpectedly, resulting in a denial-of-service. Exploitation requires a user to open a specially crafted IFC file.

CVE-2026-19568 is a high-severity buffer overflow vulnerability in Autodesk 3ds Max. It arises from improper handling of maliciously crafted SVG files, leading to memory corruption. Successful exploitation can allow arbitrary code execution within the context of the affected process. The vulnerability affects specific versions of Autodesk 3ds Max, including 2026.0.0 and 2027.0.0. No official patch or remediation guidance is currently available from the vendor. The vulnerability requires local access with user interaction to exploit, as indicated by the CVSS vector.

CVE-2026-7455 is an out-of-bounds write vulnerability in Autodesk 3ds Max triggered by parsing a maliciously crafted FLT file. Exploitation can lead to application crashes, data corruption, or arbitrary code execution within the context of the current process. The vulnerability affects specific versions 2026.0.0 and 2027.0.0 of 3ds Max. The CVSS score is 7.8, indicating high severity. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-16783 is an out-of-bounds write vulnerability in Autodesk 3ds Max triggered by parsing a maliciously crafted ABC file. Exploitation may lead to application crashes, data corruption, or arbitrary code execution within the context of the current process. The vulnerability affects specific versions 2026.0.0 and 2027.0.0 of 3ds Max. The CVSS 3.1 base score is 7.8, indicating high severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-16782 is an Out-of-Bounds Read vulnerability in Autodesk 3ds Max triggered by parsing a maliciously crafted SVG file. Exploitation can cause application crashes, leak sensitive data, or potentially allow arbitrary code execution within the process context. The vulnerability affects specific versions of 3ds Max from 2026 and 2027 releases. The CVSS score is 5.3, indicating medium severity.

CVE-2026-16781 is an uncontrolled recursion vulnerability in Autodesk 3ds Max triggered by parsing a maliciously crafted SVG file. Exploitation can cause the application to terminate unexpectedly, resulting in denial-of-service. The vulnerability affects specific versions of 3ds Max from 2026.0.0 up to but not including 2026.3.4, and from 2027.0.0 up to but not including 2027.2.0. The CVSS score is 5.5, indicating medium severity. No known exploits are reported in the wild, and no official patch information is provided in the input data.

A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerability to cause the NT AUTHORITY\SYSTEM service to terminate unexpectedly, resulting in a denial-of-service condition.

A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated IPC messages into named pipes, modify pipe permissions or ownership, and potentially impact confidentiality, integrity, and availability.

A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service

A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process.