CVE-2026-1289

A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process.

Score

CVSS 3.1 7.8 High

Status

Modified - psirt@autodesk.com

Published

2026-08-06

Last modified

2026-10-23

Weaknesses

CWE-416

Affected products

• Autocad (Autodesk)
• Autocad Lt (Autodesk)
• Dwg Trueview (Autodesk)
• Revit (Autodesk)

References

• https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0011
• https://www.autodesk.com/products/autodesk-access/overview