Overview
The vulnerability CVE-2025-5046 represents a significant risk to Autodesk AutoCAD users due to an Out-of-Bounds Read vulnerability when importing or linking a maliciously crafted DGN file. This vulnerability can lead to a system crash, data leakage, or even arbitrary code execution, contributing to potential system compromise.
Vulnerability Summary
CVE ID: CVE-2025-5046
Severity: High 7.8
Attack Vector: Local
Privileges Required: Low
User Interaction: Required
Impact: System compromise, sensitive data leakage, and potential code execution
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Autodesk AutoCAD | All versions up to date of report
How the Exploit Works
The exploit operates by manipulating the input process of DGN files in Autodesk AutoCAD. By crafting a DGN file with specific malicious content, an attacker can trigger an Out-of-Bounds Read vulnerability. This can lead to a system crash or, in more severe cases, allow the attacker to read sensitive data or execute arbitrary code in the context of the current process.
Conceptual Example Code
While the exact nature of the malicious payload may vary, the following pseudocode provides a conceptual example of how a malicious DGN file might be created to exploit this vulnerability:
# Pseudocode
malicious_dgn = DGN()
malicious_dgn.create('malicious_content')
# This content forces an Out-of-Bounds Read when imported or linked in AutoCAD
malicious_dgn.set_content('OUT_OF_BOUNDS_CONTENT')
# Write the malicious DGN file
malicious_dgn.write('malicious_file.dgn')This malicious file can then be imported into Autodesk AutoCAD, causing the vulnerability to be exploited. It is crucial to apply the vendor patch or use a WAF/IDS as a temporary mitigation to prevent this vulnerability from being exploited.