7.8Hoch
CVE-2025-5039Privilege Ecalation due to Untrusted Search Path Vulnerability
Beschreibung
A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context of the current process due to an untrusted search path being utilized.
Schwachstellentyp (CWE):
CWE-426
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| Autodesk | 3ds Max | 2027 – < 2027.1, 2026 – < 2026.3.3 | |
| Autodesk | AutoCAD | 2026 – < 2026.1 | |
| Autodesk | AutoCAD LT | 2026 – < 2026.1 | |
| autodesk | infrastructure parts editor | 2026 – < 2026.0.2 | |
| autodesk | inventor | 2026 – < 2026.0.2 | |
| autodesk | navisworks manage | 2026 – < 2026.0.2 | |
| autodesk | navisworks simulate | 2026 – < 2026.0.2 | |
| Autodesk | RealDWG | 2026 – < 2026.0.2 | |
| autodesk | revit | 2026 – < 2026.0.2 | |
| autodesk | vault | 2026 – < 2026.0.2 |
Referenzen und Patches
- https://www.autodesk.com/products/autodesk-access/overview patch
- https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0014 vendor-advisoryVendor Advisory
CPE-Treffer (NVD) (6)
cpe:2.3:a:autodesk:infrastructure_parts_editor:*:*:*:*:*:*:*:*≥ 2026 < 2026.0.2cpe:2.3:a:autodesk:inventor:*:*:*:*:*:*:*:*≥ 2026 < 2026.0.2cpe:2.3:a:autodesk:navisworks_manage:*:*:*:*:*:*:*:*≥ 2026 < 2026.0.2cpe:2.3:a:autodesk:navisworks_simulate:*:*:*:*:*:*:*:*≥ 2026 < 2026.0.2cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:*≥ 2026 < 2026.0.2cpe:2.3:a:autodesk:vault:*:*:*:*:*:*:*:*≥ 2026 < 2026.0.2