Privilege Ecalation due to Untrusted Search Path Vulnerability
Priority LOW 35CWE-426Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-426.
Summary
A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context of the current process due to an untrusted search path being utilized.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00206 10th percentileScored 2026-11-07
Fix Fixed AutoCAD (Autodesk): 2026.1AutoCAD LT (Autodesk): 2026.1+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Autodesk | AutoCAD | 2026 to before 2026.1 | 2026.1 | Patch available | CNA |
| Autodesk | AutoCAD LT | 2026 to before 2026.1 | 2026.1 | Patch available | CNA |
| Autodesk | RealDWG | 2026 to before 2026.0.2 | 2026.0.2 | Patch available | CNA |
| Autodesk | 3ds Max | 2027 to before 2027.1; 2026 to before 2026.3.3 | 2027.1, 2026.3.3 | Patch available | CNA |
- AutoCAD VendorAutodesk Affected 2026 to before 2026.1 Fixed in 2026.1 Patch available CNA
- AutoCAD LT VendorAutodesk Affected 2026 to before 2026.1 Fixed in 2026.1 Patch available CNA
- RealDWG VendorAutodesk Affected 2026 to before 2026.0.2 Fixed in 2026.0.2 Patch available CNA
- 3ds Max VendorAutodesk Affected 2027 to before 2027.1; 2026 to before 2026.3.3 Fixed in 2027.1, 2026.3.3 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:autodesk:infrastructure_parts_editor:*:*:*:*:*:*:*:* | 2026 to before 2026.0.2 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:inventor:*:*:*:*:*:*:*:* | 2026 to before 2026.0.2 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:navisworks_manage:*:*:*:*:*:*:*:* | 2026 to before 2026.0.2 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:navisworks_simulate:*:*:*:*:*:*:*:* | 2026 to before 2026.0.2 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:* | 2026 to before 2026.0.2 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:vault:*:*:*:*:*:*:*:* | 2026 to before 2026.0.2 | Vulnerable | Autodesk |
- cpe:2.3:a:autodesk:infrastructure_parts_editor:*:*:*:*:*:*:*:* Versions 2026 to before 2026.0.2 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:inventor:*:*:*:*:*:*:*:* Versions 2026 to before 2026.0.2 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:navisworks_manage:*:*:*:*:*:*:*:* Versions 2026 to before 2026.0.2 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:navisworks_simulate:*:*:*:*:*:*:*:* Versions 2026 to before 2026.0.2 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:* Versions 2026 to before 2026.0.2 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:vault:*:*:*:*:*:*:*:* Versions 2026 to before 2026.0.2 Vulnerable ·Autodesk
Remediation
- Fix · CNA AutoCAD (Autodesk) Fixed in 2026.1
- Fix · CNA AutoCAD LT (Autodesk) Fixed in 2026.1
- Fix · CNA RealDWG (Autodesk) Fixed in 2026.0.2
- Fix · CNA 3ds Max (Autodesk) Fixed in 2027.1, 2026.3.3
Timeline
- 2026-10-02 Threatist record created from CVE-2025-5039
- 2026-10-03 Alias added: GHSA-4c85-w99g-9v4w
References
More Autodesk Infrastructure Parts Editor vulnerabilities
- TI-2025-01090 DWG File Parsing Out-of-Bounds Write Vulnerability CVSS 3.1HIGH 7.8
- TI-2021-17348 Use after free in Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastructure Parts… CVSS 3.1HIGH 7.8
- TI-2021-17347 Out-of-bounds write in Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastructure… CVSS 3.1HIGH 7.8
- TI-2021-17346 Out-of-bounds write in Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastructure… CVSS 3.1HIGH 7.8
- TI-2021-17345 Out-of-bounds write in Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastructure… CVSS 3.1HIGH 7.8
- TI-2021-17344 Out-of-bounds read in Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastructure… CVSS 3.1HIGH 7.8
Sources
- CVE-2025-5039 · CVE Program
- CVE-2025-5039 · NVD
- FIRST EPSS
- GHSA-4c85-w99g-9v4w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences