Read the docs
TI-2026-81416 Aliases CVE-2026-113775GHSA-9833-v35h-4xgw

Dynamic library loading process control in Autodesk Fusion Desktop

Priority LOW 35CWE-749Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Autodesk Fusion desktop application versions from 2705.1.30 before 2706.1.14 are affected. A maliciously crafted dynamic library loaded from an arbitrary path through the TextCommands.LoadDll command of the Autodesk Fusion API exposes a dangerous function (CWE-749). A local attacker with no privileges can use this to execute arbitrary code in the context of the current process, and user interaction is required.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can trigger an Exposed Dangerous Function vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to execute arbitrary code in the context of the current process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00168 6th percentileScored 2026-11-07
Fix Fixed Fusion (Autodesk): 2706.1.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AutodeskFusion2705.1.30 to before 2706.1.142706.1.14Patch availableCNA
  • Fusion VendorAutodesk Affected 2705.1.30 to before 2706.1.14 Fixed in 2706.1.14 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:autodesk:fusion:2705.1.30:*:*:*:*:*:*:*2705.1.30—Autodesk
  • cpe:2.3:a:autodesk:fusion:2705.1.30:*:*:*:*:*:*:* Versions 2705.1.30 — ·Autodesk

Remediation

Update Autodesk Fusion to version 2706.1.14 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Fusion (Autodesk) Fixed in 2706.1.14

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Autodesk Fusion — autodesk.com/trust/security-advisories/adsk-sa-2026-0019

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-81405 Stored cross-site scripting in Autodesk Fusion Library ManagerPriority LOW 32
    • TI-2026-81404 Reflected cross-site scripting in Autodesk Fusion protocol URL handlingPriority LOW 32
    • TI-2026-81403 Stored cross-site scripting in Autodesk Fusion design namesPriority LOW 32
    Show all 4 records → Advisory →

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-113775
  2. 2026-10-27 Alias added: GHSA-9833-v35h-4xgw
  3. 2026-10-28 Priority changed: MEDIUM → LOW
  4. 2026-10-29 CISA SSVC decision points changed
  5. 2026-10-29 CISA SSVC decision points changed

References

Patch 2

Advisory 1

  • TI-2021-08603 Path traversal in Autodesk FBX Review CVSS 3.1HIGH 7.8
  • TI-2023-13523 Memory corruption in Autodesk AutoCAD, Advance Steel and Civil 3D CVSS 3.1CRITICAL 9.8
  • TI-2023-13522 Out-of-bounds write in Autodesk AutoCAD, Advance Steel and Civil 3D CVSS 3.1CRITICAL 9.8
  • TI-2014-02375 Autodesk VRED Professional 2014 before SR1 SP8 allows remote attackers to execute… CVSS 2.0HIGH 10.0
  • TI-2008-04264 The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as… CVSS 2.0HIGH 9.3
  • TI-2008-04263 Directory traversal vulnerability in the CExpressViewerControl class in the DWF Viewer… CVSS 2.0HIGH 9.3
See all 389 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences