CVE-2025-1428
Published: 13 March 2025
Description
An adversary may rely upon a user opening a malicious file in order to gain execution.
Security Summary
CVE-2025-1428 is an Out-of-Bounds Read vulnerability (CWE-125) in Autodesk AutoCAD, triggered by parsing a maliciously crafted CATPART file. Published on 2025-03-13, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw occurs during file processing, allowing potential exploitation within the application's context.
A local attacker with no privileges can exploit this vulnerability by tricking a user into opening a specially crafted CATPART file through AutoCAD, requiring user interaction. Successful exploitation enables the attacker to cause application crashes (high availability impact), read sensitive data from memory (high confidentiality impact), or execute arbitrary code (high integrity impact) in the context of the current process.
Autodesk has addressed this issue in security advisory ADSK-SA-2025-0001, available at https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001. Mitigation involves applying the latest updates for AutoCAD, with download instructions provided at https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Where-can-I-download-the-latest-update-of-AutoCAD-AutoCAD-LT-2022.html. Additional context on Autodesk Access is at https://www.autodesk.com/products/autodesk-access/overview.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is a client-side file parsing flaw in AutoCAD allowing arbitrary code execution when a user opens a malicious CATPART file, directly enabling T1203 (Exploitation for Client Execution) and T1204.002 (Malicious File under User Execution).