CVE-2025-14593: Autodesk Shared Components RCE Vulnerability

CVE-2025-14593 Overview

CVE-2025-14593 is an Out-of-Bounds Read vulnerability [CWE-125] affecting Autodesk Shared Components and a broad set of Autodesk 2026 products. A maliciously crafted CATPART file, when parsed by an affected product, triggers a memory read past the bounds of an allocated buffer. Attackers can leverage the flaw to crash the application, disclose sensitive process memory, or execute arbitrary code in the context of the current user.

Exploitation requires a local user to open the malicious file, making targeted spear-phishing and supply-chain delivery of CAD assets the most likely delivery vectors for engineering and manufacturing environments.

Critical Impact
A crafted CATPART file can crash affected Autodesk applications, leak memory contents, or execute arbitrary code with the privileges of the user running the CAD software.

Affected Products

Autodesk Shared Components
Autodesk AutoCAD 2026 and AutoCAD verticals (Architecture, Electrical, Map 3D, Mechanical, MEP, Plant 3D)
Autodesk 3ds Max 2026, Advance Steel 2026, Civil 3D 2026, InfraWorks 2026, Inventor 2026, Revit 2026, Revit LT 2026, and Vault 2026

Discovery Timeline

2025-12-16 - CVE-2025-14593 published to NVD
2025-12-19 - Last updated in NVD database

Technical Details for CVE-2025-14593

Vulnerability Analysis

The vulnerability resides in the CATPART file parser shipped with Autodesk Shared Components. CATPART is the native part-file format from CATIA, frequently imported into Autodesk products through interoperability libraries. When the parser processes a malformed structure inside the file, it reads memory outside the bounds of its allocated buffer.

An Out-of-Bounds Read condition can produce three distinct outcomes depending on the layout of adjacent memory. The process may crash when invalid memory is dereferenced, causing denial of service. The process may return uninitialized or adjacent heap contents to the caller, leaking sensitive data such as pointers, secrets, or document content. In specific conditions, the read can be combined with subsequent write primitives to achieve arbitrary code execution within the user's session.

Root Cause

The root cause is missing or incorrect bounds validation when the CATPART parser walks length-prefixed or offset-driven structures inside the file. The parser trusts attacker-controlled size or index fields and indexes into a buffer without verifying that the offset remains within the allocated region, producing the out-of-bounds read.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a crafted CATPART file through email, a shared engineering drive, a third-party model repository, or a compromised supplier. When an engineer opens or imports the file in an affected Autodesk 2026 product, the vulnerable parser is invoked. No elevated privileges are required to trigger the bug, and successful code execution runs with the privileges of the CAD user, which in engineering environments often includes access to product intellectual property.

No public proof-of-concept exploit is available for CVE-2025-14593 at the time of publication. See the Autodesk Security Advisory ADSK-SA-2025-0024 for vendor technical details.

Detection Methods for CVE-2025-14593

Indicators of Compromise

Unexpected crashes or Windows Error Reporting (WER) entries originating from Autodesk processes such as acad.exe, revit.exe, inventor.exe, or 3dsmax.exe shortly after opening a CATPART file.
Inbound CATPART files from untrusted email senders, external file-sharing links, or unverified supplier portals.
Autodesk processes spawning unexpected children such as cmd.exe, powershell.exe, or rundll32.exe after a file open event.

Detection Strategies

Hunt for child-process creation chains where an Autodesk binary is the parent of a scripting or LOLBin process, which is anomalous for normal CAD workflows.
Alert on CATPART files written to user Downloads, email attachment cache, or temp directories followed by an Autodesk process accessing the same path.
Correlate application crash telemetry with recent file-open activity to identify potential exploitation attempts that failed to achieve code execution.

Monitoring Recommendations

Forward Autodesk application logs and Windows Application event logs to a centralized SIEM for crash and exception monitoring.
Track endpoint EDR telemetry for memory-access violations inside Autodesk processes and treat them as high-fidelity investigation leads.
Monitor email and file-sharing gateways for .CATPART attachments and flag them for review when sourced externally.

How to Mitigate CVE-2025-14593

Immediate Actions Required

Apply the fixed versions published in Autodesk Security Advisory ADSK-SA-2025-0024 to all affected 2026 products and Shared Components installations.
Inventory engineering workstations to confirm which Autodesk 2026 products are deployed and prioritize patching systems that routinely import third-party CAD files.
Block or quarantine inbound .CATPART attachments at the email gateway until patching completes.

Patch Information

Autodesk has released updated builds for the affected 2026 products. Refer to Autodesk Security Advisory ADSK-SA-2025-0024 for the specific fixed version numbers per product and to the Autodesk Access overview for the deployment tooling used to distribute updates.

Workarounds

Restrict opening of CATPART files to a vetted internal source until patches are deployed across the fleet.
Run Autodesk applications under standard user accounts rather than local administrators to limit the impact of arbitrary code execution.
Use application allowlisting to prevent Autodesk processes from spawning interpreters such as powershell.exe or cmd.exe.

bash

# Example: block inbound .CATPART attachments at an Exchange transport rule
New-TransportRule -Name "Block CATPART Attachments" `
  -AttachmentExtensionMatchesWords "catpart" `
  -RejectMessageReasonText "CATPART files are blocked pending CVE-2025-14593 remediation."