CVE-2026-14479

A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerability to cause the NT AUTHORITY\SYSTEM service to terminate unexpectedly, resulting in a denial-of-service condition.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://emsfs.autodesk.com/utility/odis/1/installer/latest/AdODIS-installer.exe	Product
https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0013	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:autodesk:installer:*:*:*:*:*:*:*:*

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una entrada diseñada maliciosamente, cuyo es procesada por el analizador de tramas IPC del Instalador de Autodesk, puede desencadenar una validación incorrecta de una posición u offset especificados por la entrada, resultyo en una operación de subcadena fuera de rango. Un actor malicioso puede aprovechar esta vulnerabilidad para provocar que el servicio NT AUTHORITY\SYSTEM termine inesperadamente, resultyo en una condición de denegación de servicio.

Information

Published : 2026-08-12 15:17

Updated : 2026-10-23 20:10

NVD link : CVE-2026-14479

Mitre link : CVE-2026-14479

CVE.ORG link : CVE-2026-14479

JSON object : View

Products Affected

autodesk

installer

CWE

CWE-1285

Improper Validation of Specified Index, Position, or Offset in Input

{"id": "CVE-2026-14479", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14479", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T15:39:39.871132Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@autodesk.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "psirt@autodesk.com", "affectedData": [{"cpes": ["cpe:2.3:a:autodesk:installer:2.22.0:*:*:*:*:*:*:*"], "vendor": "Autodesk", "product": "Installer", "versions": [{"status": "affected", "version": "2.22.0", "lessThan": "2.23.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-12T15:17:31.830", "references": [{"url": "https://emsfs.autodesk.com/utility/odis/1/installer/latest/AdODIS-installer.exe", "tags": ["Product"], "source": "psirt@autodesk.com"}, {"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0013", "tags": ["Vendor Advisory"], "source": "psirt@autodesk.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@autodesk.com", "description": [{"lang": "en", "value": "CWE-1285"}]}], "descriptions": [{"lang": "en", "value": "A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerability to cause the NT AUTHORITY\\SYSTEM service to terminate unexpectedly, resulting in a denial-of-service condition."}, {"lang": "es", "value": "Una entrada dise\u00f1ada maliciosamente, cuyo es procesada por el analizador de tramas IPC del Instalador de Autodesk, puede desencadenar una validaci\u00f3n incorrecta de una posici\u00f3n u offset especificados por la entrada, resultyo en una operaci\u00f3n de subcadena fuera de rango. Un actor malicioso puede aprovechar esta vulnerabilidad para provocar que el servicio NT AUTHORITY\\SYSTEM termine inesperadamente, resultyo en una condici\u00f3n de denegaci\u00f3n de servicio."}], "lastModified": "2026-10-23T20:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:autodesk:installer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F1F3B50-4DCC-4DE7-9325-D0C8A0D97443", "versionEndExcluding": "2.23"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@autodesk.com"}