Author: Ameeba

Overview

The common vulnerabilities and exposures (CVE) system has recently identified a significant vulnerability, CVE-2025-6631, that impacts certain Autodesk products. The vulnerability is related to the parsing of a maliciously crafted PRT file which can result in an Out-of-Bounds Write vulnerability. This is an issue of concern for organizations and individuals using affected Autodesk products as it poses a serious threat to the security of their systems and data.
This flaw, if successfully exploited by a malicious actor, can lead to a system crash, data corruption, or even the execution of arbitrary code in the context of the current process. As such, the impact of this vulnerability is extensive, potentially leading to system compromise and data leakage, thereby significantly undermining data integrity and system stability.

Vulnerability Summary

CVE ID: CVE-2025-6631
Severity: High (7.8 CVSS Score)
Attack Vector: PRT file
Privileges Required: None
User Interaction: Required
Impact: System crash, data corruption, execution of arbitrary code, potential system compromise, and data leakage

Affected Products

Product | Affected Versions

Autodesk AutoCAD | All versions prior to 2025
Autodesk 3ds Max | All versions prior to 2025

How the Exploit Works

The exploit works by a malicious actor crafting a PRT file that contains specific code designed to trigger an Out-of-Bounds Write vulnerability when parsed by the affected Autodesk products. The parsing of this malicious file can cause the software to write data beyond its allocated memory buffer, leading to a number of potential malicious outcomes including a system crash, data corruption, or arbitrary code execution.

Conceptual Example Code

Here is a conceptual example of how the vulnerability might be exploited. It’s important to note that this is a hypothetical scenario and not an actual code snippet:

POST /upload/prt HTTP/1.1
Host: target.example.com
Content-Type: application/prt
{ "malicious_prt_payload": "..." }

In this example, the malicious actor would send a POST request to an endpoint that accepts PRT files on the target server. The content of the request contains the malicious PRT file payload that, when parsed by the victim’s Autodesk software, would trigger the vulnerability and lead to any of the potential impacts described above.

Overview

A newly identified vulnerability, CVE-2025-5043, exposes multiple Autodesk products to potential system compromise and data leakage. This security flaw arises when certain Autodesk products link or import a maliciously crafted 3DM file, leading to a Heap-Based Overflow vulnerability. The impacted applications include a wide range of Autodesk products, widely used by architects, engineers, and graphic designers, among others. Therefore, the potential reach and impact of this vulnerability can be considerable, affecting numerous businesses and individuals who rely on these applications for their daily operations.

Vulnerability Summary

CVE ID: CVE-2025-5043
Severity: High (7.8 CVSS score)
Attack Vector: Maliciously crafted 3DM file
Privileges Required: None
User Interaction: Required (File link or import)
Impact: Potential system compromise and data leakage

Affected Products

Product | Affected Versions

Autodesk 3ds Max | Versions X to Y
AutoCAD | Versions A to B

How the Exploit Works

The exploit works by manipulating the way Autodesk products handle 3DM files. The attacker crafts a 3DM file with malicious data designed to overflow the heap memory space allocated for the file. When this manipulated file is linked or imported into the Autodesk product, it forces a heap buffer overflow, causing the system to crash or potentially allowing the attacker to read sensitive data or execute arbitrary code in the context of the current process.

Conceptual Example Code

While the exact structure of the malicious 3DM file will vary depending on the specific Autodesk application and version targeted, a conceptual example of a payload that might trigger the vulnerability could look something like this:

#include <stdio.h>
#include <stdlib.h>
int main() {
char* buffer = (char*)malloc(1024); // Allocate buffer
FILE* file = fopen("malicious.3dm", "r"); // Open malicious file
// Overflow the buffer
fread(buffer, 2048, 1, file);
// Execute overflowed buffer
(*(void(*)()) buffer)();
return 0;
}

In the above example, the fread function reads more data into buffer than it has been allocated, causing a buffer overflow. This overflow data could contain arbitrary code that the attacker wants to execute.

Mitigation Guidance

Users affected by this vulnerability are urged to apply the vendor-provided patch to fix the flaw. As a temporary mitigation strategy, users can also leverage Web Application Firewalls (WAFs) or Intrusion Detection Systems (IDS) to detect and block attempts to exploit this vulnerability. Regular monitoring and updating of systems is advised to prevent future vulnerabilities.

Overview

The recently reported vulnerability, CVE-2025-5038, represents a significant security risk to users of certain Autodesk products. This vulnerability arises from a memory corruption issue that is triggered when parsing maliciously crafted X_T files. The severity of this threat cannot be understated, given the potential for arbitrary code execution, which could lead to severe data leakage or even system compromise. This vulnerability is especially concerning for the vast number of organizations and professionals who rely on Autodesk software for designing and modeling tasks.

Vulnerability Summary

CVE ID: CVE-2025-5038
Severity: High (7.8, CVSS v3.1)
Attack Vector: File/Link
Privileges Required: None
User Interaction: Required
Impact: System Compromise, Data Leakage

Affected Products

Product | Affected Versions

Autodesk AutoCAD | All versions up to 2025
Autodesk Inventor | All versions up to 2025

How the Exploit Works

The vulnerability originates from the software’s inability to properly handle certain parameters of X_T files. When a malicious actor crafts an X_T file with specific parameters designed to exploit this flaw, and this file is subsequently opened in the affected Autodesk product, it leads to a buffer overflow. This overflow can corrupt the memory of the running process. The attacker can then use this memory corruption to insert and execute arbitrary code in the context of the currently running process.

Conceptual Example Code

This is a conceptual example illustrating how a malicious payload might look like. Please note that the specifics can vary greatly.

#include <iostream>
#include <fstream>
int main() {
std::ofstream file;
file.open("exploit.x_t");
file << "HEADER;\n";
file << "1;" << std::string(5000, 'A') << ";\n";  // Overflow the buffer
file << "FOOTER;\n";
file.close();
return 0;
}

This code writes an X_T file with a very large string of ‘A’ characters, which could cause a buffer overflow when this file is parsed by the vulnerable software.

Mitigation

Autodesk has already issued patches to address this vulnerability. Users are strongly encouraged to apply the patch to mitigate the risk. For those who are unable to apply the patch immediately, using a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) can provide temporary mitigation. These systems should be configured to detect and block files that appear to be crafted to exploit this vulnerability.