Riskcovery

CVE-2026-7406

BMP File Parsing Untrusted Pointer Dereference in certain Autodesk products

State
Published
Severity
7.8 High
Published
Aug 6, 2026
Updated
Sep 18, 2026
Reserved
Apr 29, 2026

Read the record on cve.org

Description

A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hautodesk

Weaknesses

  • CWE-822 Untrusted Pointer Dereference

Affected Products

ProductVersions
RevitAutodesk
  • 2027.0.0 to before 2027.1.0Affected
  • 2026.0.0 to before 2026.5.0Affected
  • 2025.0.0 to before 2025.5.0Affected
  • 2024.0.0 to before 2024.3.5Affected
AutoCADAutodesk
  • 2027.0.0 to before 2027.1.0Affected
  • 2026.0.0 to before 2026.1.2Affected
AutoCAD LTAutodesk
  • 2027.0.0 to before 2027.1.0Affected
  • 2026.0.0 to before 2026.1.2Affected
DWG TrueViewAutodesk
  • 2027.0.0 to before 2027.1.0Affected
  • 2026.0.0 to before 2026.1.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.