CVE-2026-7405

A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.autodesk.com/products/autodesk-access/overview	Product
https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0012	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:autodesk:advance_steel::::::::
	cpe:2.3:a:autodesk:autocad::::::::
	cpe:2.3:a:autodesk:autocad_architecture::::::::
	cpe:2.3:a:autodesk:autocad_electrical::::::::
	cpe:2.3:a:autodesk:autocad_lt::::::::
	cpe:2.3:a:autodesk:autocad_map_3d::::::::
	cpe:2.3:a:autodesk:autocad_mechanical::::::::
	cpe:2.3:a:autodesk:autocad_mep::::::::
	cpe:2.3:a:autodesk:autocad_plant_3d::::::::
	cpe:2.3:a:autodesk:civil_3d::::::::
	cpe:2.3:a:autodesk:dwg_trueview::::::::
	cpe:2.3:a:autodesk:revit::::::::
	cpe:2.3:a:autodesk:revit::::::::
	cpe:2.3:a:autodesk:revit::::::::

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Un archivo TIF creado maliciosamente, cuando es procesado por ciertos productos de Autodesk durante la importación de imágenes, puede causar una lectura fuera de límites en la biblioteca de manejo de imágenes. Un actor malicioso puede aprovechar esta vulnerabilidad para causar una denegación de servicio.

Information

Published : 2026-08-06 22:18

Updated : 2026-10-24 15:10

NVD link : CVE-2026-7405

Mitre link : CVE-2026-7405

CVE.ORG link : CVE-2026-7405

JSON object : View

Products Affected

autodesk

autocad_lt
advance_steel
autocad
autocad_electrical
autocad_map_3d
autocad_mep
autocad_mechanical
autocad_architecture
civil_3d
dwg_trueview
revit
autocad_plant_3d

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-7405", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7405", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T17:22:24.248444Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@autodesk.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "psirt@autodesk.com", "affectedData": [{"cpes": ["cpe:2.3:a:autodesk:revit:2027:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit:2025:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit:2024:*:*:*:*:*:*:*"], "vendor": "Autodesk", "product": "Revit", "versions": [{"status": "affected", "version": "2027.0.0", "lessThan": "2027.1.0", "versionType": "semver"}, {"status": "affected", "version": "2026.0.0", "lessThan": "2026.5.0", "versionType": "semver"}, {"status": "affected", "version": "2025.0.0", "lessThan": "2025.5.0", "versionType": "semver"}, {"status": "affected", "version": "2024.0.0", "lessThan": "2024.3.5", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:*"], "vendor": "Autodesk", "product": "AutoCAD", "versions": [{"status": "affected", "version": "2027.0.0", "lessThan": "2027.1.0", "versionType": "semver"}, {"status": "affected", "version": "2026.0.0", "lessThan": "2026.1.2", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:*"], "vendor": "Autodesk", "product": "AutoCAD LT", "versions": [{"status": "affected", "version": "2027.0.0", "lessThan": "2027.1.0", "versionType": "semver"}, {"status": "affected", "version": "2026.0.0", "lessThan": "2026.1.2", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:*"], "vendor": "Autodesk", "product": "DWG TrueView", "versions": [{"status": "affected", "version": "2027.0.0", "lessThan": "2027.1.0", "versionType": "semver"}, {"status": "affected", "version": "2026.0.0", "lessThan": "2026.1.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-06T22:18:32.707", "references": [{"url": "https://www.autodesk.com/products/autodesk-access/overview", "tags": ["Product"], "source": "psirt@autodesk.com"}, {"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0012", "tags": ["Vendor Advisory"], "source": "psirt@autodesk.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@autodesk.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service"}, {"lang": "es", "value": "Un archivo TIF creado maliciosamente, cuando es procesado por ciertos productos de Autodesk durante la importaci\u00f3n de im\u00e1genes, puede causar una lectura fuera de l\u00edmites en la biblioteca de manejo de im\u00e1genes. Un actor malicioso puede aprovechar esta vulnerabilidad para causar una denegaci\u00f3n de servicio."}], "lastModified": "2026-10-24T15:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:autodesk:advance_steel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A64C402-3A58-4E4D-B2F4-0D6740556857", "versionEndExcluding": "2027.1", "versionStartIncluding": "2027"}, {"criteria": "cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B989AB28-B0B3-48EC-9AB7-C843B2D2C22D", "versionEndExcluding": "2027.1", "versionStartIncluding": "2027"}, {"criteria": "cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F61FBCB-AA8C-4C02-BC1C-4B03248550A0", "versionEndExcluding": "2027.1", "versionStartIncluding": "2027"}, {"criteria": "cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2B92B8C-E946-4396-B88E-C2234CEF724E", "versionEndExcluding": "2027.1", "versionStartIncluding": "2027"}, {"criteria": "cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6BE11239-64C9-4CFD-843C-9379ABD44B5D", "versionEndExcluding": "2027.1", "versionStartIncluding": "2027"}, {"criteria": "cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D67D455D-167C-47A3-B52B-CD6603312547", "versionEndExcluding": "2027.1", "versionStartIncluding": "2027"}, {"criteria": "cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17978643-83AB-4176-9522-BD1416CE93CF", "versionEndExcluding": "2027.1", "versionStartIncluding": "2027"}, {"criteria": "cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0FA36A5-0C2B-4C73-9D5A-8B8B8163E43C", "versionEndExcluding": "2027.1", "versionStartIncluding": "2027"}, {"criteria": "cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4F54366-2733-4DBA-A481-2E868D18E4EB", "versionEndExcluding": "2027.1", "versionStartIncluding": "2027"}, {"criteria": "cpe:2.3:a:autodesk:civil_3d:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4FB306B4-64F2-4E59-A068-D0514D9853BF", "versionEndExcluding": "2027.1", "versionStartIncluding": "2027"}, {"criteria": "cpe:2.3:a:autodesk:dwg_trueview:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC01517D-2853-4901-BDE7-8EEFAB9E570F", "versionEndExcluding": "2027.1", "versionStartIncluding": "2027"}, {"criteria": "cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DF83739-35DB-4D58-94C7-282B101E7DB1", "versionEndExcluding": "2025.3.5", "versionStartIncluding": "2025"}, {"criteria": "cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D3A12A9-E8C2-4D85-B7C7-9392F2DFCA83", "versionEndExcluding": "2026.5", "versionStartIncluding": "2026"}, {"criteria": "cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D869F549-A639-48CB-8F4D-DCF3B92D1291", "versionEndExcluding": "2027.1", "versionStartIncluding": "2027"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@autodesk.com"}