CVE-2025-10885: Autodesk Installer Privilege Escalation

CVE-2025-10885 Overview

CVE-2025-10885 is a local privilege escalation vulnerability in Autodesk Installer. The flaw stems from insufficient validation of loaded binaries, allowing a maliciously crafted file to execute with elevated privileges when run on a victim's machine. An attacker with local, low-privileged access can leverage this weakness to obtain code execution as NT AUTHORITY\SYSTEM. The vulnerability is tracked under [CWE-250: Execution with Unnecessary Privileges] and requires user interaction to trigger. Autodesk published advisory ADSK-SA-2025-0022 describing the issue and providing fixed installer builds.

Critical Impact
Successful exploitation grants SYSTEM-level code execution on Windows hosts running affected Autodesk Installer versions, enabling full host compromise from a low-privileged user context.

Affected Products

Autodesk Installer (Windows)
Autodesk ODIS Installer (AdODIS-installer.exe)
Products deployed through the affected Autodesk Installer component

Discovery Timeline

2025-11-06 - CVE-2025-10885 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10885

Vulnerability Analysis

The vulnerability resides in the Autodesk Installer's binary loading routine. The installer runs with elevated privileges during product installation and update operations. When the installer loads supporting binaries, it does not adequately verify the integrity, signature, or origin of those binaries before executing them. An attacker who places a maliciously crafted file in a location the installer references can have that file loaded and executed in the high-privilege installer context. The result is code execution as NT AUTHORITY\SYSTEM, the highest privilege level on Windows. Because the privileged process willingly loads attacker-controlled code, this issue maps directly to [CWE-250: Execution with Unnecessary Privileges]. The attack is local and requires the victim to execute the crafted file, but no prior authentication is needed beyond standard user access to the machine.

Root Cause

The root cause is missing or incomplete validation of loaded binaries inside a process that runs with elevated rights. Trust decisions are made based on file path or presence rather than cryptographic verification. Common patterns that match this profile include unsigned DLL loading, insecure search-order resolution, and execution of helper executables without code-signing checks.

Attack Vector

A low-privileged local user stages a malicious binary in a directory the installer reads from, or supplies a crafted file that the installer processes. The user then triggers the installer flow. The installer loads the attacker's binary into its SYSTEM context and runs the embedded payload. No network access is needed; the attack surface is local with required user interaction.

No verified public proof-of-concept code is available. See the Autodesk Security Advisory ADSK-SA-2025-0022 for vendor-supplied technical detail.

Detection Methods for CVE-2025-10885

Indicators of Compromise

Unsigned or untrusted DLLs and executables loaded by AdODIS-installer.exe or other Autodesk installer processes.
New child processes spawned by Autodesk installer binaries running as NT AUTHORITY\SYSTEM that do not match known Autodesk component hashes.
Files written to user-writable directories that are subsequently loaded by an elevated Autodesk installer process.

Detection Strategies

Hunt for image loads into Autodesk installer processes originating from non-standard paths such as %TEMP%, %APPDATA%, or user profile directories.
Correlate process-creation events where the parent is an Autodesk installer and the child executes outside the expected install path tree.
Alert on code-signing anomalies: modules loaded by installer processes that are unsigned, expired, or signed by an unexpected publisher.

Monitoring Recommendations

Enable Sysmon Event IDs 1 (process create), 7 (image loaded), and 11 (file create) with rules targeting Autodesk installer image paths.
Forward EDR telemetry covering DLL load events and integrity-level transitions to a centralized analytics platform for retrospective hunting.
Audit endpoints where Autodesk products are installed for unexpected files in directories adjacent to installer binaries.

How to Mitigate CVE-2025-10885

Immediate Actions Required

Apply the fixed Autodesk Installer release referenced in Autodesk Security Advisory ADSK-SA-2025-0022.
Restrict local interactive logon on systems running Autodesk software to trusted administrators where feasible.
Educate users to refuse execution of installer-related files received from untrusted sources, given the user-interaction requirement.

Patch Information

Autodesk has released an updated Autodesk Installer build addressing the insufficient binary validation flaw. The latest ODIS installer is available at the Autodesk ODIS Installer download endpoint. Confirm version and remediation guidance against the vendor advisory before deployment. Replace older installer copies cached on file shares, software-distribution points, and golden images.

Workarounds

Remove stale Autodesk Installer binaries from shared locations and developer workstations until the patched version is deployed.
Enforce Windows Defender Application Control or AppLocker policies that block execution of unsigned binaries from user-writable directories.
Tighten NTFS ACLs on installer working directories to prevent low-privileged users from placing files that the installer might load.

bash

# Example AppLocker rule (PowerShell) blocking unsigned executables from user temp paths
New-AppLockerPolicy -RuleType Path -User Everyone -Action Deny \
  -Path "%OSDRIVE%\Users\*\AppData\Local\Temp\*.exe" \
  -RuleNamePrefix "Block-Unsigned-Installer-Helpers"