CVE-2026-1289

PDF File Parsing Vulnerabilities in Certain Autodesk Desktop Products

State: Published
Severity: 7.8 High
Published: Aug 6, 2026
Updated: Oct 19, 2026
Reserved: Jan 21, 2026

Description

A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	autodesk

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
RevitAutodesk	2027.0.0 to before 2027.2.0Affected 2026.0.0 to before 2026.5.0Affected 2025.0.0 to before 2025.4.6Affected 2024.0.0 to before 2024.3.6Affected
AutoCADAutodesk	2027.0.0 to before 2027.1.0Affected 2026.0.0 to before 2026.1.2Affected 2025.0.0 to before 2025.1.4Affected 2024.0.0 to before 2024.1.9Affected
AutoCAD LTAutodesk	2027.0.0 to before 2027.1.0Affected 2026.0.0 to before 2026.1.2Affected 2025.0.0 to before 2025.1.4Affected 2024.0.0 to before 2024.1.9Affected
DWG TrueViewAutodesk	2027.0.0 to before 2027.1.0Affected 2026.0.0 to before 2026.1.2Affected 2025.0.0 to before 2025.1.4Affected 2024.0.0 to before 2024.1.9Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.