CVE-2025-1276: Autodesk Advance Steel RCE Vulnerability

CVE-2025-1276 Overview

CVE-2025-1276 is an out-of-bounds write vulnerability [CWE-787] affecting multiple Autodesk applications that parse DWG files. A maliciously crafted DWG file, when opened in an affected Autodesk product, triggers an out-of-bounds write condition in memory. An attacker can leverage this flaw to crash the application, corrupt data, or execute arbitrary code in the context of the current process. The vulnerability requires local file access and user interaction, typically through opening a weaponized DWG file delivered via phishing or supply chain channels. Autodesk published security advisory ADSK-SA-2025-0004 documenting the issue across its design and engineering software portfolio.

Critical Impact
Successful exploitation allows arbitrary code execution in the context of the user running the Autodesk application, enabling attackers to compromise engineering workstations through a single weaponized DWG file.

Affected Products

Autodesk AutoCAD and AutoCAD LT (along with AutoCAD Architecture, Electrical, Map 3D, Mechanical, MEP, Plant 3D)
Autodesk Civil 3D, Advance Steel, Revit, Inventor, and Vault
Autodesk DWG TrueView, Navisworks Manage, Navisworks Simulate, and Infrastructure Parts Editor

Discovery Timeline

2025-04-15 - CVE-2025-1276 published to NVD
2025-08-19 - Last updated in NVD database

Technical Details for CVE-2025-1276

Vulnerability Analysis

The vulnerability resides in the DWG file parsing logic shared across Autodesk's product line. DWG is Autodesk's proprietary binary format for storing 2D and 3D design data, including geometry, metadata, and embedded objects. When the parser processes a malformed DWG structure, it writes data beyond the bounds of an allocated buffer, corrupting adjacent memory regions.

An attacker controlling the malformed structure can influence what gets written and where. This converts a parsing flaw into a primitive for hijacking program control flow. The shared file format library means a single weaponized DWG can affect AutoCAD, Revit, Inventor, and other downstream products that consume DWG content.

Exploitation requires the victim to open the malicious DWG file in an affected application. Code execution occurs in the security context of the logged-in user, making engineering workstations with elevated local privileges particularly attractive targets.

Root Cause

The root cause is improper bounds checking [CWE-787] during deserialization of DWG file structures. The parser fails to validate the size or offset fields of certain records before writing data into memory buffers. Attacker-controlled fields in the file determine the destination address or length of the write operation, enabling memory corruption.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious DWG file and delivers it through email attachments, file-sharing platforms, compromised CAD libraries, or supply chain distribution. When a victim opens the file in an affected Autodesk application, the parser triggers the out-of-bounds write. No network exposure or authentication bypass is required.

The vulnerability manifests during DWG deserialization. Refer to the Autodesk Security Advisory ADSK-SA-2025-0004 for affected version details and patched releases.

Detection Methods for CVE-2025-1276

Indicators of Compromise

Unexpected crashes of acad.exe, revit.exe, inventor.exe, or other Autodesk processes following the opening of a DWG file
Autodesk application processes spawning unusual child processes such as cmd.exe, powershell.exe, or rundll32.exe
DWG files arriving from untrusted external sources, particularly via email attachments or non-corporate file shares
Outbound network connections originating from Autodesk application processes shortly after file open events

Detection Strategies

Monitor process creation events where Autodesk binaries are the parent process and spawn shell or scripting interpreters
Hunt for memory access violations and Windows Error Reporting events tied to Autodesk executables across endpoints
Inspect DWG files at email and web gateways for malformed headers or anomalous record structures
Correlate file open telemetry with subsequent suspicious process or network activity using EDR storyline data

Monitoring Recommendations

Enable detailed audit logging for Autodesk application launches and file open operations on engineering workstations
Track DWG file ingress points including email gateways, collaboration platforms, and external storage media
Alert on Autodesk process injections, unsigned module loads, or suspicious thread creation patterns
Baseline normal Autodesk application behavior to surface anomalies indicative of exploitation

How to Mitigate CVE-2025-1276

Immediate Actions Required

Apply the patched Autodesk product versions identified in Autodesk Security Advisory ADSK-SA-2025-0004 without delay
Inventory all Autodesk installations across engineering and design teams to confirm patch coverage
Restrict opening of DWG files originating from untrusted sources until patching is complete
Communicate the risk to CAD users and require verification of DWG file origin before opening

Patch Information

Autodesk has released updated versions of the affected products. Customers should consult the Autodesk Security Advisory ADSK-SA-2025-0004 and use Autodesk Access to deploy fixed versions across AutoCAD, Revit, Inventor, Civil 3D, Navisworks, DWG TrueView, Vault, and related products.

Workarounds

Block inbound DWG files from external email senders at the mail gateway until patching is verified
Open untrusted DWG files only inside isolated virtual machines or sandboxed environments without sensitive data access
Run Autodesk applications under standard user accounts rather than local administrator accounts to limit post-exploitation impact
Disable automatic preview generation for DWG files in file explorers and document management systems

bash

# Example: Inventory Autodesk product versions on Windows endpoints via PowerShell
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.Publisher -like "*Autodesk*" } |
  Select-Object DisplayName, DisplayVersion, InstallDate |
  Sort-Object DisplayName