CVE-2026-16463

Analyzed Analyzed - Analysis Complete

Heap-Based Overflow in AutoCAD via Malicious DXF File

Publication date: 2026-07-29

Last updated on: 2026-08-12

Assigner: Autodesk

Description

A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-12

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-16463

Affected Vendors & Products

Vendor	Product	Version / Range
autodesk	advance_steel	2027
autodesk	autocad	2027
autodesk	autocad_architecture	2027
autodesk	autocad_electrical	2027
autodesk	autocad_lt	2027
autodesk	autocad_map_3d	2027
autodesk	autocad_mechanical	2027
autodesk	autocad_mep	2027
autodesk	autocad_plant_3d	2027
autodesk	civil_3d	2027
autodesk	dwg_trueview	2027
autodesk	advance_steel	From 2026 (inc) to 2026.1.2 (exc)
autodesk	autocad	From 2026 (inc) to 2026.1.2 (exc)
autodesk	autocad_architecture	From 2026 (inc) to 2026.1.2 (exc)
autodesk	autocad_electrical	From 2026 (inc) to 2026.1.2 (exc)
autodesk	autocad_lt	From 2026 (inc) to 2026.1.2 (exc)
autodesk	autocad_map_3d	From 2026 (inc) to 2026.1.2 (exc)
autodesk	autocad_mechanical	From 2026 (inc) to 2026.1.2 (exc)
autodesk	autocad_mep	From 2026 (inc) to 2026.1.2 (exc)
autodesk	autocad_plant_3d	From 2026 (inc) to 2026.1.2 (exc)
autodesk	civil_3d	From 2026 (inc) to 2026.1.2 (exc)
autodesk	dwg_trueview	From 2026 (inc) to 2026.1.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability involves a maliciously crafted DXF file that, when opened in Autodesk AutoCAD, triggers a heap-based overflow. This flaw can be exploited to crash the application, access sensitive memory data, or run arbitrary code within the same process as AutoCAD.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes or unusual behavior when processing DXF files with Autodesk AutoCAD. Check for heap overflow errors in logs or system crash reports. Ensure AutoCAD is updated to the latest version to mitigate risks.

Impact Analysis

If exploited, this vulnerability could allow an attacker to take control of your AutoCAD session, potentially stealing sensitive data, installing malware, or disrupting your workflow. It requires user interaction, such as opening a malicious DXF file.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Update Autodesk AutoCAD to the latest version to patch the Heap-Based Overflow vulnerability in DXF file parsing. Avoid opening untrusted DXF files and implement network monitoring for suspicious file activity.

Hi! I’m here to help you understand CVE-2026-16463. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70