DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD

Summary

CVE	CVE-2026-17550
State	PUBLISHED
Assigner	autodesk
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-07-29 16:17:51 UTC
Updated	2026-08-17 14:11:42 UTC
Description	A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information.

Primary CVSS: v3.1 5.5 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS: 0.001450000 probability, percentile 0.042990000 (date 2026-08-17)

Problem Types: CWE-125 | CWE-125 CWE-125 Out-of-bounds Read

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Secondary	5.5	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H`
3.1	CNA	CVSS	5.5	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H`

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Type	Vendor	Product	Version	Update	Edition	Language
Application	Autodesk	Advance Steel	All	All	All	All
Application	Autodesk	Advance Steel	2027	All	All	All
Application	Autodesk	Autocad	All	All	All	All
Application	Autodesk	Autocad	2027	All	All	All
Application	Autodesk	Autocad Architecture	All	All	All	All
Application	Autodesk	Autocad Architecture	2027	All	All	All
Application	Autodesk	Autocad Electrical	All	All	All	All
Application	Autodesk	Autocad Electrical	2027	All	All	All
Application	Autodesk	Autocad Lt	All	All	All	All
Application	Autodesk	Autocad Lt	2027	All	All	All
Application	Autodesk	Autocad Map 3d	All	All	All	All
Application	Autodesk	Autocad Map 3d	2027	All	All	All
Application	Autodesk	Autocad Mechanical	All	All	All	All
Application	Autodesk	Autocad Mechanical	2027	All	All	All
Application	Autodesk	Autocad Mep	All	All	All	All
Application	Autodesk	Autocad Mep	2027	All	All	All
Application	Autodesk	Autocad Plant 3d	All	All	All	All
Application	Autodesk	Autocad Plant 3d	2027	All	All	All
Application	Autodesk	Civil 3d	All	All	All	All
Application	Autodesk	Civil 3d	2027	All	All	All
Application	Autodesk	Dwg Trueview	All	All	All	All
Application	Autodesk	Dwg Trueview	2027	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Autodesk	AutoCAD	affected 2027.0.0 2027.1.0 semver	Not specified
CNA	Autodesk	AutoCAD	affected 2026.0.0 2026.1.2 semver	Not specified
CNA	Autodesk	AutoCAD LT	affected 2027.0.0 2027.1.0 semver	Not specified
CNA	Autodesk	AutoCAD LT	affected 2026.0.0 2026.1.2 semver	Not specified
CNA	Autodesk	DWG TrueView	affected 2027.0.0 2027.1.0 semver	Not specified
CNA	Autodesk	DWG TrueView	affected 2026.0.0 2026.1.2 semver	Not specified

Reference	Source	Link	Tags
www.autodesk.com/products/dwg-trueview/overview	[email protected]	www.autodesk.com	Product
www.autodesk.com/trust/security-advisories/adsk-sa-2026-0009	[email protected]	www.autodesk.com	Vendor Advisory
www.autodesk.com/products/autodesk-access/overview	[email protected]	www.autodesk.com	Product
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.