CVE-2026-16465

Analyzed Analyzed - Analysis Complete

Out-of-Bounds Read in AutoCAD via Malicious DWG/DXF File

Publication date: 2026-07-29

Last updated on: 2026-08-11

Assigner: Autodesk

Description

A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-11

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-16465

Affected Vendors & Products

Vendor	Product	Version / Range
autodesk	advance_steel	2027
autodesk	autocad	2027
autodesk	autocad_architecture	2027
autodesk	autocad_electrical	2027
autodesk	autocad_lt	2027
autodesk	autocad_map_3d	2027
autodesk	autocad_mechanical	2027
autodesk	autocad_mep	2027
autodesk	autocad_plant_3d	2027
autodesk	civil_3d	2027
autodesk	dwg_trueview	2027
autodesk	advance_steel	From 2026 (inc) to 2026.1.2 (exc)
autodesk	autocad	From 2026 (inc) to 2026.1.2 (exc)
autodesk	autocad_architecture	From 2026 (inc) to 2026.1.2 (exc)
autodesk	autocad_electrical	From 2026 (inc) to 2026.1.2 (exc)
autodesk	autocad_lt	From 2026 (inc) to 2026.1.2 (exc)
autodesk	autocad_map_3d	From 2026 (inc) to 2026.1.2 (exc)
autodesk	autocad_mechanical	From 2026 (inc) to 2026.1.2 (exc)
autodesk	autocad_mep	From 2026 (inc) to 2026.1.2 (exc)
autodesk	autocad_plant_3d	From 2026 (inc) to 2026.1.2 (exc)
autodesk	civil_3d	From 2026 (inc) to 2026.1.2 (exc)
autodesk	dwg_trueview	From 2026 (inc) to 2026.1.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability involves a maliciously crafted DWG or DXF file that, when opened in Autodesk AutoCAD, triggers an Out-of-Bounds Read. This occurs when the software attempts to read data outside the intended memory buffer, potentially leading to crashes or unauthorized access to sensitive information.

Detection Guidance

Detection involves monitoring for crashes or unusual behavior when processing DWG or DXF files in Autodesk AutoCAD. Check system logs for application crashes or memory access violations during file parsing. No specific commands are provided in the context.

Impact Analysis

The impact includes system crashes when opening affected files, which could disrupt workflows. Additionally, sensitive information might be disclosed if the vulnerability is exploited, posing risks to data confidentiality.

Compliance Impact

This vulnerability could potentially lead to disclosure of sensitive information due to the Out-of-Bounds Read issue in AutoCAD when processing maliciously crafted DWG or DXF files. This may impact compliance with GDPR if personal data is exposed, or HIPAA if protected health information is involved.

Mitigation Strategies

Avoid opening untrusted DWG or DXF files in Autodesk AutoCAD. Update AutoCAD to the latest patched version if available. Implement file validation and sandboxing for suspicious files.

Hi! I’m here to help you understand CVE-2026-16465. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70