CVE-2025-1432
Published: 13 March 2025
Description
An adversary may rely upon a user opening a malicious file in order to gain execution.
Security Summary
CVE-2025-1432 is a Use-After-Free vulnerability (CWE-416) affecting Autodesk AutoCAD. The issue arises when AutoCAD parses a maliciously crafted 3DM file, which can trigger the vulnerability. Published on 2025-03-13, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
An attacker with local access can exploit this vulnerability by tricking a user into opening a malicious 3DM file through AutoCAD, requiring no special privileges but relying on user interaction. Successful exploitation allows the attacker to cause a denial-of-service crash, read sensitive data from memory, or execute arbitrary code within the context of the AutoCAD process.
Autodesk has issued security advisory ADSK-SA-2025-0001 addressing this vulnerability. Mitigation involves applying the latest updates available through Autodesk's support resources, such as download instructions for AutoCAD and AutoCAD LT updates.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The Use-After-Free in AutoCAD's 3DM parser directly enables arbitrary code execution upon opening a malicious file, mapping to Exploitation for Client Execution (T1203) and User Execution via Malicious File (T1204.002).