PDF File Parsing Heap-Based Overflow Vulnerability

Summary

A maliciously crafted PDF file, when linked or imported into Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

Timeline

1. Apr 15, 2025, 8:56 PM UTCCVE published
2. Apr 18, 2025, 3:55 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Feb 26, 2026, 6:28 PM UTCRecord last updated

Affected versions

• Autodesk Revit

  From 2025 · fixed in 2025.4.1; From 2024 · fixed in 2024.3.2; From 2023 · fixed in 2023.1.7

• Autodesk AutoCAD

  From 2025 · fixed in 2025.1.3; From 2024 · fixed in 2024.1.8; From 2023 · fixed in 2023.1.8

• Autodesk AutoCAD LT

  From 2025 · fixed in 2025.1.3; From 2024 · fixed in 2024.1.8; From 2023 · fixed in 2023.1.8

• Autodesk AutoCAD Architecture

  From 2025 · fixed in 2025.1.3; From 2024 · fixed in 2024.1.8; From 2023 · fixed in 2023.1.8

• Autodesk AutoCAD Electrical

  From 2025 · fixed in 2025.1.3; From 2024 · fixed in 2024.1.8; From 2023 · fixed in 2023.1.8

• Autodesk AutoCAD MAP 3D

  From 2025 · fixed in 2025.1.3; From 2024 · fixed in 2024.1.8; From 2023 · fixed in 2023.1.8

• Autodesk AutoCAD Mechanical

  From 2025 · fixed in 2025.1.3; From 2024 · fixed in 2024.1.8; From 2023 · fixed in 2023.1.8

• Autodesk AutoCAD MEP

  From 2025 · fixed in 2025.1.3; From 2024 · fixed in 2024.1.8; From 2023 · fixed in 2023.1.8

• Autodesk AutoCAD Plant 3D

  From 2025 · fixed in 2025.1.3; From 2024 · fixed in 2024.1.8; From 2023 · fixed in 2023.1.8

• Autodesk Civil 3D

  From 2025 · fixed in 2025.1.3; From 2024 · fixed in 2024.1.8; From 2023 · fixed in 2023.1.8

• Autodesk Advance Steel

  From 2025 · fixed in 2025.1.3; From 2024 · fixed in 2024.1.8; From 2023 · fixed in 2023.1.8

References 2