7.8High
CVE-2025-5039Privilege Ecalation due to Untrusted Search Path Vulnerability
Description
A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context of the current process due to an untrusted search path being utilized.
Weakness (CWE):
CWE-426
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Autodesk | 3ds Max | 2027 – < 2027.1, 2026 – < 2026.3.3 | |
| Autodesk | AutoCAD | 2026 – < 2026.1 | |
| Autodesk | AutoCAD LT | 2026 – < 2026.1 | |
| autodesk | infrastructure parts editor | 2026 – < 2026.0.2 | |
| autodesk | inventor | 2026 – < 2026.0.2 | |
| autodesk | navisworks manage | 2026 – < 2026.0.2 | |
| autodesk | navisworks simulate | 2026 – < 2026.0.2 | |
| Autodesk | RealDWG | 2026 – < 2026.0.2 | |
| autodesk | revit | 2026 – < 2026.0.2 | |
| autodesk | vault | 2026 – < 2026.0.2 |
References and patches
- https://www.autodesk.com/products/autodesk-access/overview patch
- https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0014 vendor-advisoryVendor Advisory
CPE matches (NVD) (6)
cpe:2.3:a:autodesk:infrastructure_parts_editor:*:*:*:*:*:*:*:*≥ 2026 < 2026.0.2cpe:2.3:a:autodesk:inventor:*:*:*:*:*:*:*:*≥ 2026 < 2026.0.2cpe:2.3:a:autodesk:navisworks_manage:*:*:*:*:*:*:*:*≥ 2026 < 2026.0.2cpe:2.3:a:autodesk:navisworks_simulate:*:*:*:*:*:*:*:*≥ 2026 < 2026.0.2cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:*≥ 2026 < 2026.0.2cpe:2.3:a:autodesk:vault:*:*:*:*:*:*:*:*≥ 2026 < 2026.0.2