CVE-2025-5335: Autodesk Installer Privilege Escalation

CVE-2025-5335 Overview

CVE-2025-5335 is a local privilege escalation vulnerability in the Autodesk Installer application. The flaw stems from an untrusted search path [CWE-426] used by the installer when loading binaries during execution. An attacker who plants a maliciously crafted binary in a location searched by the installer can achieve code execution as NT AUTHORITY\SYSTEM.

Exploitation requires local access and user interaction, typically by tricking a user into downloading the installer alongside the malicious payload. Successful exploitation yields full system-level privileges on Windows hosts.

Critical Impact
Successful exploitation grants NT AUTHORITY\SYSTEM privileges, giving attackers complete administrative control over the affected Windows host.

Affected Products

Autodesk Installer (AdODIS-installer.exe) — versions prior to the fixed release
Windows installations that retrieve the installer through the standard Autodesk download channel
Autodesk product deployments relying on the Open Data Installation Service (ODIS)

Discovery Timeline

2025-06-10 - CVE-2025-5335 published to the National Vulnerability Database (NVD)
2025-11-13 - Last updated in NVD database

Technical Details for CVE-2025-5335

Vulnerability Analysis

The Autodesk Installer loads supporting binaries using an untrusted search path. When the installer process starts, it resolves dependent libraries or executables from directories an attacker can write to. This behavior is classified under [CWE-426] (Untrusted Search Path).

Because the installer typically runs with elevated rights to deploy Autodesk software, any code loaded from an attacker-controlled location inherits those rights. The result is code execution under the NT AUTHORITY\SYSTEM account.

Exploitation does not require network access. The attacker needs the victim to download both the legitimate installer and a malicious binary side by side, then launch the installer.

Root Cause

The installer does not enforce fully qualified paths or signature validation when resolving dependencies. Windows DLL and executable search order rules then permit a planted binary in the current working directory or another searched location to be loaded ahead of the legitimate file. This is a classic binary planting condition.

Attack Vector

An attacker delivers a crafted binary, often through a phishing payload, drive-by download, or compromised download bundle, to the directory where the user saves AdODIS-installer.exe. When the user executes the installer, Windows resolves the dependency from the attacker-controlled file before the legitimate one. The malicious binary then runs in the installer's elevated context.

A functional exploit requires no specialized tooling beyond a renamed DLL or executable placed in the installer's working directory. See the Autodesk Security Advisory ADSK-SA-2025-0010 for vendor-confirmed technical details.

Detection Methods for CVE-2025-5335

Indicators of Compromise

Unsigned or unexpected DLL and EXE files in the same directory as AdODIS-installer.exe, particularly in user Downloads folders
Child processes spawned by AdODIS-installer.exe running as NT AUTHORITY\SYSTEM that do not match known Autodesk binaries
Outbound network connections initiated by processes parented to the Autodesk installer immediately after launch

Detection Strategies

Monitor process creation events where AdODIS-installer.exe is the parent and the child image path resolves outside Autodesk's expected install directories
Hunt for module loads from %USERPROFILE%\Downloads or other user-writable paths into installer processes running with elevated tokens
Alert on file writes of executable content adjacent to the installer binary shortly before the installer is launched

Monitoring Recommendations

Enable Windows Sysmon Event ID 7 (Image Loaded) and Event ID 1 (Process Create) to capture DLL search order anomalies
Track integrity-level transitions where medium-integrity processes spawn SYSTEM-level children through installer binaries
Correlate browser download telemetry with subsequent installer launches to identify suspicious co-located binaries

How to Mitigate CVE-2025-5335

Immediate Actions Required

Download the Autodesk Installer only from the official Autodesk distribution channel and verify the digital signature before execution
Run installers from a clean directory containing only the signed Autodesk binary, not from the default Downloads folder
Restrict administrative privileges and require User Account Control (UAC) prompts for installer execution

Patch Information

Autodesk has released a fixed version of the installer. Refer to the Autodesk Security Advisory ADSK-SA-2025-0010 for the corrected build and download instructions. Replace any cached copies of AdODIS-installer.exe with the patched release before deploying or updating Autodesk products.

Workarounds

Execute the installer from a dedicated, empty directory to remove the possibility of adjacent malicious binaries being loaded
Apply AppLocker or Windows Defender Application Control policies to block unsigned executables and DLLs from loading in installer contexts
Educate users to scan downloaded archives and avoid extracting installer bundles from untrusted sources

bash

# Verify the Authenticode signature of the Autodesk Installer before execution
Get-AuthenticodeSignature "C:\Installers\Autodesk\AdODIS-installer.exe" |
    Select-Object Status, SignerCertificate, Path