AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

AutodeskCVE-2026-7406

Autodesk AutoCAD: code execution

Autodesk

CVE-2026-7406 · Published Aug 6, 2026 · updated Sep 18, 2026

High7.8
Fix: upgrade to Revit 2027.1.0 or later (5 fixed versions below)
Autodesk advisory

A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

Affected versions

PackageAffectedFixed in
AutoCAD
Product
>= 2027.0.0, < 2027.1.02027.1.0
>= 2026.0.0, < 2026.1.22026.1.2
AutoCAD LT
Product
>= 2027.0.0, < 2027.1.02027.1.0
>= 2026.0.0, < 2026.1.22026.1.2
DWG TrueView
Product
>= 2027.0.0, < 2027.1.02027.1.0
>= 2026.0.0, < 2026.1.22026.1.2
Revit
Product
>= 2027.0.0, < 2027.1.02027.1.0
>= 2026.0.0, < 2026.5.02026.5.0
>= 2025.0.0, < 2025.5.02025.5.0
>= 2024.0.0, < 2024.3.52024.3.5
Details and references
CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-822

More Autodesk advisories

All Autodesk
High 7.8Aug 6Autodesk Revit: out-of-bounds writeCVE-2026-8325fixed in 2027.2.0 +3Medium 5.5Aug 6Autodesk AutoCAD: out-of-bounds readCVE-2026-7405fixed in Revit 2027.1.0 +4High 7.8Aug 6Autodesk AutoCAD: use after freeCVE-2026-1289fixed in Revit 2027.2.0 +5High 7.8Aug 6Autodesk AutoCAD: out-of-bounds readCVE-2026-11803fixed in Revit 2027.2.0 +5High 7.8Aug 4Autodesk FBX SDK: stack buffer overflowCVE-2026-10709fixed in 2020.3.10High 7.8Aug 4Autodesk FBX SDK: stack buffer overflowCVE-2026-10710fixed in 2020.3.10