Autodesk vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-113775 A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can triggHigh 7.8 · Oct 27, 2026
• CVE-2026-102638 A maliciously crafted HTML payload in the description of an electronic library (.lbr) file, when displayed in the Library Manager after the library is imported,High 7.1 · Oct 27, 2026
• CVE-2026-102637 A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected CHigh 7.1 · Oct 27, 2026
• CVE-2026-102636 A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cross-site Scripting (High 7.1 · Oct 27, 2026
• CVE-2026-107672 A maliciously crafted .stack.json file can trigger a trusted Markdown injection vulnerability in Autodesk Fusion Post Processor Utility Extension.High 8.8 · Oct 27, 2026
• CVE-2026-15102 ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text.High 7.5 · Oct 14, 2026
• CVE-2026-85217 A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify persistent network proxy settings without user notification or High 8.6 · Sep 10, 2026
• CVE-2026-7455 A maliciously crafted FLT file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability.High 7.8 · Aug 24, 2026
• CVE-2026-19568 A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability.High 7.8 · Aug 24, 2026
• CVE-2026-16783 A maliciously crafted ABC file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability.High 7.8 · Aug 24, 2026
• CVE-2026-14478 A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated IPC messages into nHigh 7.8 · Aug 12, 2026
• CVE-2026-8325 A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability.High 7.8 · Aug 6, 2026
• CVE-2026-7406 A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability.High 7.8 · Aug 6, 2026
• CVE-2026-1289 A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability.High 7.8 · Aug 6, 2026
• CVE-2026-11803 A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability.High 7.8 · Aug 6, 2026
• CVE-2026-10710 A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive.High 7.8 · Aug 4, 2026
• CVE-2026-10709 A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::FbxIO::BinaryReadSectioHigh 7.8 · Aug 4, 2026
• CVE-2026-16463 A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability.High 7.8 · Jul 29, 2026
• CVE-2026-10789 A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCPCritical 9.6 · Jun 22, 2026
• CVE-2026-7454 A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability.High 7.8 · May 26, 2026
• CVE-2026-7452 A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability.High 7.8 · May 26, 2026
• CVE-2026-7451 A maliciously crafted TIF file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability.High 7.8 · May 26, 2026
• CVE-2026-4369 A maliciously crafted HTML payload in an assembly variant name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a StoredHigh 7.1 · Apr 14, 2026
• CVE-2026-4345 A maliciously crafted HTML payload, stored in a design name and exported to CSV, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk FHigh 7.1 · Apr 14, 2026
• CVE-2026-4344 A maliciously crafted HTML payload in a component name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-sHigh 7.1 · Apr 14, 2026