High severity · published Apr 11, 2022
CVE-2022-25796
A Double Free vulnerability allows remote malicious actors to execute arbitrary code on DWF file in Autodesk Navisworks 2022 within affected installations
7.8
CVSS
1.1%
EPSS
No
On KEV
Description
A Double Free vulnerability allows remote malicious actors to execute arbitrary code on DWF file in Autodesk Navisworks 2022 within affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
Navisworks · Autodesk
2022 before 2022.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-25796
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-25796
Vendor Advisory
https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0005
More from Navisworks
7.8
CVE-2025-1660
DWFX File Parsing Memory Corruption Vulnerability
7.8
CVE-2025-1659
DWFX File Parsing Out-of-Bounds Read Vulnerability
7.8
CVE-2025-1658
DWFX File Parsing Out-of-Bounds Read Vulnerability
7.8
CVE-2024-12671
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability
7.8
CVE-2024-12670
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability