CVE-2025-10883: Autodesk Shared Components RCE Flaw

CVE-2025-10883 Overview

CVE-2025-10883 is an out-of-bounds read vulnerability [CWE-125] affecting Autodesk Shared Components and multiple downstream Autodesk applications. The flaw resides in the parser that handles CATPRODUCT files, a CATIA assembly format consumed by several Autodesk 2026 products. A maliciously crafted CATPRODUCT file forces the parser to read memory outside the bounds of an allocated buffer. An attacker can use this condition to crash the host application, disclose sensitive process memory, or execute arbitrary code in the context of the current user.

Critical Impact
Successful exploitation grants arbitrary code execution within the user's session, exposing engineering workstations and intellectual property stored on them.

Affected Products

Autodesk Shared Components, AutoCAD 2026 and verticals (Architecture, Electrical, Map 3D, Mechanical, MEP, Plant 3D)
Autodesk 3ds Max 2026, Advance Steel 2026, Civil 3D 2026, Inventor 2026, InfraWorks 2026
Autodesk Revit 2026, Revit LT 2026, and Vault 2026

Discovery Timeline

2025-12-16 - CVE-2025-10883 published to NVD
2025-12-19 - Last updated in NVD database

Technical Details for CVE-2025-10883

Vulnerability Analysis

The vulnerability lives in the CATPRODUCT file parser shipped through Autodesk Shared Components. CATPRODUCT files describe assembly hierarchies and reference external CATIA part files. When the parser ingests a crafted file, it reads beyond the boundary of a heap-allocated structure, classifying the flaw as an out-of-bounds read [CWE-125].

Exploitation requires user interaction. A target must open the malicious file in any affected Autodesk application. Because CATPRODUCT files can be received through email, shared engineering repositories, or supply chain workflows, the social engineering barrier is low for industrial environments. The flaw runs at the privilege of the executing user, which typically includes write access to design data and network shares.

Root Cause

The parser fails to validate offset or length fields embedded inside the CATPRODUCT structure before dereferencing them. Untrusted size fields drive a read operation against an allocated buffer, allowing the read to extend past the buffer end. Depending on the adjacent memory layout, the disclosed bytes can reveal heap metadata, pointers, or other process secrets that aid in bypassing exploit mitigations such as ASLR.

Attack Vector

An attacker delivers a weaponized .CATProduct file to an engineer or CAD operator. When the file is opened, the vulnerable parser in Autodesk Shared Components triggers the out-of-bounds read. The condition can be chained with additional memory corruption primitives in the same parser to achieve arbitrary code execution in the application process. No network exposure or elevated privileges are required, but the user must open the file.

No public proof-of-concept code is available for this vulnerability. Refer to the Autodesk Security Advisory 2025-0024 for vendor technical details.

Detection Methods for CVE-2025-10883

Indicators of Compromise

Unexpected crashes or Watson/WER reports referencing acad.exe, revit.exe, inventor.exe, 3dsmax.exe, or Autodesk Shared Components DLLs after opening a CATPRODUCT file
Inbound .CATProduct or .CATPart files arriving from untrusted email senders or external file shares
Child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned by an Autodesk application following file open
Anomalous outbound network connections originating from Autodesk processes after document parsing

Detection Strategies

Hunt for Autodesk application processes spawning interpreters or LOLBins through endpoint telemetry and process-lineage queries
Alert on .CATProduct files written to user download directories or extracted from email attachments
Correlate application crash events (Event ID 1000) for Autodesk binaries with recent file-open activity
Use SentinelOne Singularity Endpoint behavioral AI to surface anomalous post-exploitation activity originating from CAD processes

Monitoring Recommendations

Forward Windows Application and Sysmon logs from engineering workstations into a centralized data lake for cross-host correlation
Track file-open telemetry for CATPRODUCT and related CATIA formats across the design team fleet
Monitor Autodesk Access update channels to verify timely patch deployment

How to Mitigate CVE-2025-10883

Immediate Actions Required

Update all Autodesk 2026 products to the fixed versions listed in Autodesk Security Advisory 2025-0024
Use Autodesk Access to push updates across managed engineering endpoints
Block inbound .CATProduct and .CATPart attachments at the email gateway pending verification
Restrict CAD operators to standard user accounts to limit the blast radius of code execution

Patch Information

Autodesk has released fixed versions of Shared Components and the affected 2026 product line. Patch availability and version mappings are documented in the Autodesk Security Advisory 2025-0024. Apply updates through Autodesk Access or the vendor download portal.

Workarounds

Do not open CATPRODUCT files received from untrusted or unverified sources
Open suspicious CAD files inside an isolated virtual machine without network access
Apply Windows attack surface reduction rules that block Office and design applications from launching child processes

bash

# Verify installed Autodesk product versions on Windows
Get-WmiObject -Class Win32_Product | Where-Object { $_.Vendor -like "*Autodesk*" } | Select-Object Name, Version

# Block CATPRODUCT attachments at the mail gateway (example for Exchange Transport Rule)
New-TransportRule -Name "Block-CATPRODUCT" -AttachmentExtensionMatchesWords "CATProduct","CATPart" -RejectMessageReasonText "File type blocked pending CVE-2025-10883 remediation"