7.8Alta
CVE-2025-5039Privilege Ecalation due to Untrusted Search Path Vulnerability
Descripción
A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context of the current process due to an untrusted search path being utilized.
Debilidad (CWE):
CWE-426
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Autodesk | 3ds Max | 2027 – < 2027.1, 2026 – < 2026.3.3 | |
| Autodesk | AutoCAD | 2026 – < 2026.1 | |
| Autodesk | AutoCAD LT | 2026 – < 2026.1 | |
| autodesk | infrastructure parts editor | 2026 – < 2026.0.2 | |
| autodesk | inventor | 2026 – < 2026.0.2 | |
| autodesk | navisworks manage | 2026 – < 2026.0.2 | |
| autodesk | navisworks simulate | 2026 – < 2026.0.2 | |
| Autodesk | RealDWG | 2026 – < 2026.0.2 | |
| autodesk | revit | 2026 – < 2026.0.2 | |
| autodesk | vault | 2026 – < 2026.0.2 |
Referencias y parches
- https://www.autodesk.com/products/autodesk-access/overview patch
- https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0014 vendor-advisoryVendor Advisory
Coincidencias CPE (NVD) (6)
cpe:2.3:a:autodesk:infrastructure_parts_editor:*:*:*:*:*:*:*:*≥ 2026 < 2026.0.2cpe:2.3:a:autodesk:inventor:*:*:*:*:*:*:*:*≥ 2026 < 2026.0.2cpe:2.3:a:autodesk:navisworks_manage:*:*:*:*:*:*:*:*≥ 2026 < 2026.0.2cpe:2.3:a:autodesk:navisworks_simulate:*:*:*:*:*:*:*:*≥ 2026 < 2026.0.2cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:*≥ 2026 < 2026.0.2cpe:2.3:a:autodesk:vault:*:*:*:*:*:*:*:*≥ 2026 < 2026.0.2