CVE-2026-1288

RFA File Parsing Vulnerability in Autodesk Revit

State: Published
Severity: 5.5 Medium
Published: Jun 17, 2026
Updated: Jun 17, 2026
Reserved: Jan 21, 2026

Description

A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	autodesk

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
RevitAutodesk	2027.0.0 to before 2027.1.0Affected 2026.0.0 to before 2026.4.1Affected 2025.0.0 to before 2025.4.5Affected 2024.0.0 to before 2024.3.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.