Cyber Posture

CVE-2025-1428

High

Published: 13 March 2025

Published
13 March 2025
Modified
19 August 2025
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0038 59.4th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may rely upon a user opening a malicious file in order to gain execution.

Security Summary

CVE-2025-1428 is an Out-of-Bounds Read vulnerability (CWE-125) in Autodesk AutoCAD, triggered by parsing a maliciously crafted CATPART file. Published on 2025-03-13, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw occurs during file processing, allowing potential exploitation within the application's context.

A local attacker with no privileges can exploit this vulnerability by tricking a user into opening a specially crafted CATPART file through AutoCAD, requiring user interaction. Successful exploitation enables the attacker to cause application crashes (high availability impact), read sensitive data from memory (high confidentiality impact), or execute arbitrary code (high integrity impact) in the context of the current process.

Autodesk has addressed this issue in security advisory ADSK-SA-2025-0001, available at https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001. Mitigation involves applying the latest updates for AutoCAD, with download instructions provided at https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Where-can-I-download-the-latest-update-of-AutoCAD-AutoCAD-LT-2022.html. Additional context on Autodesk Access is at https://www.autodesk.com/products/autodesk-access/overview.

Details

CWE(s)
CWE-125

Affected Products

autodesk
autocad
2022 — 2022.1.6 · 2023 — 2023.1.7 · 2024 — 2024.1.7
autodesk
autocad architecture
2022 — 2022.1.6 · 2023 — 2023.1.7 · 2024 — 2024.1.7
autodesk
autocad electrical
2022 — 2022.1.6 · 2023 — 2023.1.7 · 2024 — 2024.1.7
autodesk
autocad mechanical
2022 — 2022.1.6 · 2023 — 2023.1.7 · 2024 — 2024.1.7
autodesk
autocad mep
2022 — 2022.1.6 · 2023 — 2023.1.7 · 2024 — 2024.1.7
autodesk
autocad plant 3d
2022 — 2022.1.6 · 2023 — 2023.1.7 · 2024 — 2024.1.7
autodesk
civil 3d
2022 — 2022.1.6 · 2023 — 2023.1.7 · 2024 — 2024.1.7
autodesk
advance steel
2022 — 2022.1.6 · 2023 — 2023.1.7 · 2024 — 2024.1.7
autodesk
autocad map 3d
2022 — 2022.1.6 · 2023 — 2023.1.7 · 2024 — 2024.1.7

MITRE ATT&CK Enterprise Techniques

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

The vulnerability is a client-side file parsing flaw in AutoCAD allowing arbitrary code execution when a user opens a malicious CATPART file, directly enabling T1203 (Exploitation for Client Execution) and T1204.002 (Malicious File under User Execution).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References