CVE-2025-8894: Autodesk AutoCAD Plant 3D Buffer Overflow

CVE-2025-8894 Overview

CVE-2025-8894 is a heap-based buffer overflow [CWE-122] affecting multiple Autodesk products that parse PDF files. A maliciously crafted PDF, when opened by an affected Autodesk application, triggers memory corruption in the PDF parsing component. Attackers can leverage the flaw to cause an application crash, read sensitive process memory, or execute arbitrary code in the context of the current user.

The issue requires user interaction and a local attack vector. An attacker must convince a user to open the malicious PDF inside an affected Autodesk product such as AutoCAD or Revit.

Critical Impact

Successful exploitation results in arbitrary code execution in the context of the current user across the AutoCAD product family, Civil 3D, Revit, and Advance Steel.

Affected Products

• Autodesk AutoCAD and AutoCAD LT, plus the vertical variants AutoCAD Architecture, Electrical, Mechanical, MEP, Map 3D, and Plant 3D
• Autodesk Civil 3D, Revit, and Advance Steel
• Refer to Autodesk Security Advisory ADSK-SA-2025-0018 for specific version ranges

Discovery Timeline

• 2025-09-16 - CVE-2025-8894 published to NVD
• 2025-09-19 - Last updated in NVD database

Technical Details for CVE-2025-8894

Vulnerability Analysis

The vulnerability resides in the PDF parsing logic shared across Autodesk's desktop applications. When the affected products process a specially crafted PDF object, the parser writes beyond the bounds of a heap-allocated buffer. This out-of-bounds write corrupts adjacent heap metadata or object data structures within the running process.

Because the corrupted memory belongs to the AutoCAD or Revit process, an attacker who controls the overflow contents can hijack control flow. The result is arbitrary code execution under the user account running the application. The same defect can be used to read sensitive in-process data or trigger a denial-of-service crash if reliable code execution is not achievable.

Root Cause

The defect is classified as CWE-122: Heap-based Buffer Overflow. The parser fails to validate the size of attacker-controlled fields within the PDF structure before copying their contents into a fixed-size heap allocation. Insufficient bounds checking allows the write to extend past the allocation boundary.

Attack Vector

The attack vector is local with required user interaction. A target user must open a malicious PDF through an affected Autodesk product. Delivery typically occurs through phishing emails, shared project files, or compromised CAD asset libraries. No additional privileges are required prior to exploitation, and successful exploitation grants the attacker the privileges of the logged-in user.

No public proof-of-concept exploit and no CISA KEV listing exist for CVE-2025-8894 at the time of writing. The current EPSS score is 0.048%.

Detection Methods for CVE-2025-8894

Indicators of Compromise

• Unexpected crashes of acad.exe, Revit.exe, or other Autodesk product executables shortly after opening an externally sourced PDF
• Autodesk product processes spawning unusual child processes such as cmd.exe, powershell.exe, or rundll32.exe
• PDF files arriving from untrusted email or file-sharing sources targeting CAD or BIM engineering teams
• Unexplained outbound network connections originating from an Autodesk product process

Detection Strategies

• Monitor process telemetry for memory access violations and Windows Error Reporting events tied to Autodesk binaries
• Inspect process lineage to identify Autodesk applications spawning interactive shells or scripting interpreters
• Apply behavioral analytics to flag heap corruption indicators such as crashes followed by code execution patterns
• Inventory PDF files referenced by Autodesk projects and flag samples with malformed object streams

Monitoring Recommendations

• Centralize endpoint logs for engineering workstations and alert on Autodesk process anomalies
• Track file open events for PDFs across CAD and BIM workflows to correlate with subsequent process behavior
• Maintain version inventories of installed Autodesk products and compare them against the patched versions listed in ADSK-SA-2025-0018

How to Mitigate CVE-2025-8894

Immediate Actions Required

• Update all affected Autodesk products to the fixed versions identified in Autodesk Security Advisory ADSK-SA-2025-0018
• Use the Autodesk Access client to deploy updates across managed workstations
• Restrict opening of PDF files sourced from untrusted senders within Autodesk applications
• Communicate the risk to engineering and design teams who routinely consume external PDFs

Patch Information

Autodesk has released fixed builds for each affected product. Administrators should consult ADSK-SA-2025-0018 for the exact patched version for AutoCAD, AutoCAD LT, AutoCAD Architecture, Electrical, Mechanical, MEP, Map 3D, Plant 3D, Civil 3D, Revit, and Advance Steel. Apply updates through Autodesk Access or the Autodesk Account portal.

Workarounds

• Avoid opening untrusted PDF attachments inside Autodesk products until patches are applied
• Open PDFs in a dedicated PDF reader rather than importing them through Autodesk PDF workflows where possible
• Enforce application allowlisting to prevent unexpected child processes from launching from Autodesk binaries
• Run Autodesk products under standard user accounts to limit the blast radius of in-process code execution