Use-After-Free in Autodesk Revit via Malicious PDF

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: Autodesk

Description

A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-1289

Affected Vendors & Products

Vendor	Product	Version / Range
autodesk	revit	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability involves a maliciously crafted PDF file that, when processed by Autodesk Revit, triggers a Use-After-Free flaw. This occurs when a program attempts to use memory after it has been freed, potentially leading to crashes, data leaks, or arbitrary code execution within the affected process.

Impact Analysis

If exploited, this vulnerability could allow an attacker to crash your Autodesk Revit application, access sensitive data stored in memory, or run malicious code on your system. This could compromise your system's integrity, confidentiality, or availability.

Mitigation Strategies

Update Autodesk Revit to the latest patched version immediately. Avoid opening untrusted PDF files in Revit. Implement network monitoring for suspicious file parsing activities.

Hi! I’m here to help you understand CVE-2026-1289. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70