High severity · published Oct 27, 2026
CVE-2026-113775
Dynamic Library Loading Process Control in Autodesk Fusion Desktop
New
7.8
CVSS
–
EPSS
No
On KEV
Description
A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can trigger an Exposed Dangerous Function vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FU
Fusion · Autodesk
2705.1.30 before 2706.1.14 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-113775
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-113775
dl.appstreaming.autodesk.com
https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg
dl.appstreaming.autodesk.com
https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe
www.autodesk.com
https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0019
More from Fusion
9.6
CVE-2026-10789
MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop
8.7
CVE-2025-10244
A maliciously crafted HTML payload, when rendered by the Autodesk Fusion desktop application, can trigger a Stored Cross-site Scripting (XSS) vulnerability
8.6
CVE-2026-85217
Man-in-the-Middle (MITM) Vulnerability in Autodesk Fusion Desktop
8.1
CVE-2026-0535
A maliciously crafted HTML payload, stored in a component’s description and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion…
8.1
CVE-2026-0534
A maliciously crafted HTML payload, stored in a part’s attribute and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion…