High severity · published Jul 24, 2025
CVE-2025-5039
A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context of the current…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context of the current process due to an untrusted search path being utilized.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IP
Infrastructure Parts Editor · Autodesk
2026 before 2026.0.2 · source: NVD
IN
Inventor · Autodesk
2026 before 2026.0.2 · source: NVD
NM
Navisworks Manage · Autodesk
2026 before 2026.0.2 · source: NVD
NS
Navisworks Simulate · Autodesk
2026 before 2026.0.2 · source: NVD
RE
Revit · Autodesk
2026 before 2026.0.2 · source: NVD
VA
Vault · Autodesk
2026 before 2026.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-5039
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-5039
www.autodesk.com
https://www.autodesk.com/products/autodesk-access/overview
Vendor Advisory
https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0014
More from Infrastructure Parts Editor
7.8
CVE-2025-1276
A maliciously crafted DWG file, when parsed through certain Autodesk applications, can force an Out-of-Bounds Write vulnerability
7.8
CVE-2021-40164
A heap-based buffer overflow could occur while parsing TIFF, PICT, TGA, or RLC files
7.8
CVE-2021-40162
A maliciously crafted TIF, PICT, TGA, or RLC files in Autodesk Image Processing component may be forced to read beyond allocated boundaries when parsing the TIFF, PICT, TGA, or…
7.8
CVE-2021-40166
A maliciously crafted PNG file in Autodesk Image Processing component may be used to attempt to free an object that has already been freed while parsing them
7.8
CVE-2021-40165
A maliciously crafted TIFF, PICT, TGA, or RLC file in Autodesk Image Processing component may be used to write beyond the allocated buffer while parsing TIFF, PICT, TGA, or RLC…