Vulnerability · Published Aug 6, 2026 · Assigned by autodesk
CVE-2026-1289PDF File Parsing Vulnerabilities in Certain Autodesk Desktop Products
High 7.8
In plain English
A high-severity use-after-free in AutoCAD from Autodesk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 90.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Autodesk | Revit | 2027.0.0 – before 2027.2.02026.0.0 – before 2026.5.02025.0.0 – before 2025.4.62024.0.0 – before 2024.3.6 |
| Autodesk | AutoCAD | 2027.0.0 – before 2027.1.02026.0.0 – before 2026.1.22025.0.0 – before 2025.1.42024.0.0 – before 2024.1.9 |
| Autodesk | AutoCAD LT | 2027.0.0 – before 2027.1.02026.0.0 – before 2026.1.22025.0.0 – before 2025.1.42024.0.0 – before 2024.1.9 |
| Autodesk | DWG TrueView | 2027.0.0 – before 2027.1.02026.0.0 – before 2026.1.22025.0.0 – before 2025.1.42024.0.0 – before 2024.1.9 |
Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H