Read the docs
TI-2026-06509 Aliases CVE-2026-7406GHSA-m87c-m8m3-v6f3

BMP File Parsing Untrusted Pointer Dereference in certain Autodesk products

Priority LOW 35CWE-822Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-822 and the CVSS impact.

Summary

A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00193 9th percentileScored 2026-11-07
Fix Fixed Revit (Autodesk): 2027.1.0, 2026.5.0, 2025.5.0 +1AutoCAD (Autodesk): 2027.1.0, 2026.1.2+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AutodeskRevit2027.0.0 to before 2027.1.0; 2026.0.0 to before 2026.5.0; 2025.0.0 to before 2025.5.0; 2024.0.0 to before 2024.3.52027.1.0, 2026.5.0, 2025.5.0, 2024.3.5Patch availableCNA
AutodeskAutoCAD2027.0.0 to before 2027.1.0; 2026.0.0 to before 2026.1.22027.1.0, 2026.1.2Patch availableCNA
AutodeskAutoCAD LT2027.0.0 to before 2027.1.0; 2026.0.0 to before 2026.1.22027.1.0, 2026.1.2Patch availableCNA
AutodeskDWG TrueView2027.0.0 to before 2027.1.0; 2026.0.0 to before 2026.1.22027.1.0, 2026.1.2Patch availableCNA
  • Revit VendorAutodesk Affected 2027.0.0 to before 2027.1.0; 2026.0.0 to before 2026.5.0; 2025.0.0 to before 2025.5.0; 2024.0.0 to before 2024.3.5 Fixed in 2027.1.0, 2026.5.0, 2025.5.0, 2024.3.5 Patch available CNA
  • AutoCAD VendorAutodesk Affected 2027.0.0 to before 2027.1.0; 2026.0.0 to before 2026.1.2 Fixed in 2027.1.0, 2026.1.2 Patch available CNA
  • AutoCAD LT VendorAutodesk Affected 2027.0.0 to before 2027.1.0; 2026.0.0 to before 2026.1.2 Fixed in 2027.1.0, 2026.1.2 Patch available CNA
  • DWG TrueView VendorAutodesk Affected 2027.0.0 to before 2027.1.0; 2026.0.0 to before 2026.1.2 Fixed in 2027.1.0, 2026.1.2 Patch available CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:autodesk:advance_steel:*:*:*:*:*:*:*:*2027 to before 2027.1VulnerableAutodesk
cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*2027 to before 2027.1VulnerableAutodesk
cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*2027 to before 2027.1VulnerableAutodesk
cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*2027 to before 2027.1VulnerableAutodesk
cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:*:*:*2027 to before 2027.1VulnerableAutodesk
cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:*2027 to before 2027.1VulnerableAutodesk
cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*2027 to before 2027.1VulnerableAutodesk
cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*2027 to before 2027.1VulnerableAutodesk
cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*2027 to before 2027.1VulnerableAutodesk
cpe:2.3:a:autodesk:civil_3d:*:*:*:*:*:*:*:*2027 to before 2027.1VulnerableAutodesk
  • cpe:2.3:a:autodesk:advance_steel:*:*:*:*:*:*:*:* Versions 2027 to before 2027.1 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:* Versions 2027 to before 2027.1 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:* Versions 2027 to before 2027.1 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:* Versions 2027 to before 2027.1 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:*:*:* Versions 2027 to before 2027.1 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:* Versions 2027 to before 2027.1 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:* Versions 2027 to before 2027.1 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:* Versions 2027 to before 2027.1 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:* Versions 2027 to before 2027.1 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:civil_3d:*:*:*:*:*:*:*:* Versions 2027 to before 2027.1 Vulnerable ·Autodesk
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:autodesk:dwg_trueview:*:*:*:*:*:*:*:*2027 to before 2027.1VulnerableAutodesk
cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:*2025 to before 2025.3.5; 2026 to before 2026.5; 2027 to before 2027.1VulnerableAutodesk
  • cpe:2.3:a:autodesk:dwg_trueview:*:*:*:*:*:*:*:* Versions 2027 to before 2027.1 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:* Versions 2025 to before 2025.3.5; 2026 to before 2026.5; 2027 to before 2027.1 Vulnerable ·Autodesk

Remediation

  • Fix · CNA Revit (Autodesk) Fixed in 2027.1.0, 2026.5.0, 2025.5.0, 2024.3.5
  • Fix · CNA AutoCAD (Autodesk) Fixed in 2027.1.0, 2026.1.2
  • Fix · CNA AutoCAD LT (Autodesk) Fixed in 2027.1.0, 2026.1.2
  • Fix · CNA DWG TrueView (Autodesk) Fixed in 2027.1.0, 2026.1.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Autodesk AutoCAD, AutoCAD LT and 2 more products — autodesk.com/trust/security-advisories/adsk-sa-2026-0012

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-06508 TIF File Parsing Out-of-Bounds Read in certain Autodesk productsPriority LOW 24
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-7406
  2. 2026-10-03 Alias added: GHSA-m87c-m8m3-v6f3

References

Patch 1

Advisory 1

  • TI-2021-17340 Out-of-bounds read in Inventor CVSS 3.1HIGH 7.8
  • TI-2021-17341 Information disclosure in Inventor CVSS 3.1HIGH 7.8
  • TI-2022-09360 Out-of-bounds write in Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD… CVSS 3.1HIGH 7.8
  • TI-2024-15258 Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software CVSS 3.1HIGH 7.8
  • TI-2021-08615 Improper handling of exceptional conditions in Autodesk Advanced Steel, Civil 3D… CVSS 3.1HIGH 7.8
  • TI-2019-05247 Uncontrolled search path in Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT… CVSS 3.0HIGH 7.8
See all 94 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences