CVE-2025-1652
Published: 13 March 2025
Description
An adversary may rely upon a user opening a malicious file in order to gain execution.
Security Summary
CVE-2025-1652 is an Out-of-Bounds Read vulnerability (CWE-125) affecting Autodesk AutoCAD. The issue arises when AutoCAD parses a maliciously crafted MODEL file, potentially leading to a crash, disclosure of sensitive data, or arbitrary code execution in the context of the current process. Published on 2025-03-13, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H).
The vulnerability requires local access and low attack complexity but no privileges, relying on user interaction to open the malicious MODEL file. An attacker can exploit it to crash the application, read sensitive information from memory, or achieve remote code execution within the AutoCAD process sandbox.
Autodesk's security advisory (ADSK-SA-2025-0001) addresses the vulnerability, with patches available through Autodesk Access and specific update downloads for AutoCAD and AutoCAD LT 2022 via support articles. Security practitioners should apply these updates promptly to mitigate risks.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is triggered when a user opens a maliciously crafted MODEL file in AutoCAD, directly enabling T1204.002 Malicious File under User Execution to achieve arbitrary code execution, info disclosure, or crash.