CVE-2025-1429
Published: 13 March 2025
Description
An adversary may rely upon a user opening a malicious file in order to gain execution.
Security Summary
CVE-2025-1429 is a heap-based buffer overflow vulnerability (CWE-122, CWE-787) affecting Autodesk AutoCAD. The issue arises when the software parses a maliciously crafted MODEL file, potentially leading to memory corruption. Published on 2025-03-13, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high impact with low attack complexity but requiring local access and user interaction.
An attacker can exploit this vulnerability by convincing a user to open a specially crafted MODEL file in AutoCAD on a local system. No special privileges are required, but the user must interact by loading the file. Successful exploitation allows the attacker to cause a denial-of-service via application crash, read sensitive data from memory, or execute arbitrary code within the context of the AutoCAD process.
Autodesk has addressed the vulnerability in security advisory ADSK-SA-2025-0001. Mitigation involves applying the latest updates available for AutoCAD and AutoCAD LT, downloadable from Autodesk's support pages.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Buffer overflow in AutoCAD MODEL file parser directly enables client-side arbitrary code execution (T1203) when a user opens a malicious file (T1204.002).