CVE-2025-5039: Autodesk Infrastructure Parts RCE Flaw

CVE-2025-5039 Overview

CVE-2025-5039 is an untrusted search path vulnerability [CWE-426] affecting multiple Autodesk desktop applications. A maliciously crafted binary file, when present during file loading operations, causes the application to load attacker-controlled code from an untrusted directory. Successful exploitation results in arbitrary code execution in the context of the current user process. The vulnerability requires local access and user interaction, such as opening a project file from a directory containing the malicious binary.

Critical Impact
Attackers achieve arbitrary code execution within Autodesk applications, leading to full compromise of confidentiality, integrity, and availability on the affected workstation.

Affected Products

Autodesk Infrastructure Parts Editor
Autodesk Inventor, Revit, and Vault
Autodesk Navisworks Manage and Navisworks Simulate

Discovery Timeline

2025-07-24 - CVE-2025-5039 published to NVD
2025-08-19 - Last updated in NVD database

Technical Details for CVE-2025-5039

Vulnerability Analysis

The flaw originates from how affected Autodesk applications resolve dependent binaries during file load operations. The applications search directories in an order that includes attacker-controllable locations before trusted system paths. When a user opens a project or design file, the process loads a malicious binary placed alongside it instead of the intended library.

The vulnerability maps to [CWE-426] Untrusted Search Path. Because the loaded code executes inside the application process, attackers inherit the privileges of the logged-in user. On engineering workstations, that often includes access to design intellectual property, network shares, and credential material cached by the application.

Exploitation is local, requires user interaction, and does not require prior authentication to the application itself.

Root Cause

Affected Autodesk applications use insecure DLL or module search behavior when loading files. The process does not enforce a fully qualified path or a trusted directory whitelist for dependent binaries. An attacker who places a crafted DLL or binary in a directory consulted during the search sequence causes the loader to bind to attacker code rather than the legitimate library.

Attack Vector

The attack vector is local. An attacker stages a malicious binary, typically a DLL, in a directory the target user will browse to. The attacker then delivers a legitimate-looking Autodesk project file (.rvt, .ipt, .nwd, or similar) inside the same directory through phishing, removable media, or a shared network drive. When the engineer double-clicks the project file, the Autodesk application launches, locates the planted binary during its search sequence, and loads it into the process. The injected code runs with the user's privileges. The vulnerability mechanism is documented in the Autodesk Security Advisory ADSK-SA-2025-0014.

Detection Methods for CVE-2025-5039

Indicators of Compromise

Unsigned or anomalously signed DLL files located in directories alongside Autodesk project files (.rvt, .ipt, .nwd, .iam).
Autodesk processes such as Revit.exe, Inventor.exe, or Navisworks.exe loading modules from user-writable paths like Downloads, Desktop, or network shares.
Child processes spawned from Autodesk applications that perform network connections, credential access, or PowerShell execution.

Detection Strategies

Monitor image-load events from Autodesk processes and alert when a loaded DLL resides outside the application installation directory or System32.
Hunt for project files and DLLs co-located in user-writable directories using endpoint telemetry.
Apply YARA or signature checks against DLLs in directories that recently received Autodesk file types.

Monitoring Recommendations

Enable Sysmon Event ID 7 (Image Loaded) on engineering workstations and forward to a central SIEM for correlation.
Track creation of .dll files in directories that already contain Autodesk project artifacts.
Alert on unexpected child processes from Autodesk binaries, particularly cmd.exe, powershell.exe, rundll32.exe, and regsvr32.exe.

How to Mitigate CVE-2025-5039

Immediate Actions Required

Apply the fixed versions listed in Autodesk Security Advisory ADSK-SA-2025-0014 using Autodesk Access.
Instruct users to open project files only from trusted, controlled directories rather than Downloads or removable media.
Inventory engineering workstations to confirm which Autodesk products and versions are deployed.

Patch Information

Autodesk has released updated versions for Infrastructure Parts Editor, Inventor, Navisworks Manage, Navisworks Simulate, Revit, and Vault. Refer to ADSK-SA-2025-0014 for product-specific fixed builds. Distribute updates through Autodesk Access or your standard software deployment pipeline.

Workarounds

Store all Autodesk project files in dedicated, access-controlled directories that do not allow users to drop arbitrary executables.
Enforce application control policies (Windows Defender Application Control, AppLocker) that block unsigned DLL loads by Autodesk processes.
Restrict write access to shared engineering drives so that only approved engineers can place files alongside project data.

bash

# Example AppLocker DLL rule (PowerShell) to block unsigned DLLs in user-writable paths
New-AppLockerPolicy -RuleType Path -User Everyone -Action Deny `
  -Path "%OSDRIVE%\Users\*\Downloads\*.dll" `
  -RuleNamePrefix "Block-Autodesk-DLL-Hijack"