CVE-2026-0875: Autodesk MODEL File RCE Vulnerability

CVE-2026-0875 Overview

A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. This vulnerability poses a significant risk to organizations using affected Autodesk products, as successful exploitation could lead to complete system compromise.

Critical Impact

Successful exploitation allows attackers to execute arbitrary code in the context of the current process, potentially leading to complete system compromise, data theft, or lateral movement within enterprise networks.

Affected Products

• Autodesk products capable of parsing MODEL files
• Products covered under Autodesk Access subscription
• See Autodesk Security Advisory ADSK-SA-2026-0004 for the complete list of affected products and versions

Discovery Timeline

• 2026-02-18 - CVE-2026-0875 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-0875

Vulnerability Analysis

This vulnerability is classified as CWE-787 (Out-of-Bounds Write), a memory corruption flaw that occurs when software writes data past the boundaries of allocated memory. In the context of CVE-2026-0875, the vulnerability is triggered during the parsing of specially crafted MODEL files by Autodesk products.

The attack requires local access and user interaction, meaning an attacker must convince a user to open a malicious MODEL file. Once opened, the parsing routines fail to properly validate input data boundaries, allowing the attacker to write arbitrary data beyond the intended memory buffer. This memory corruption can be leveraged to overwrite critical program data structures, function pointers, or return addresses on the stack.

Root Cause

The root cause of this vulnerability lies in insufficient bounds checking within the MODEL file parsing functionality. When processing certain malformed or oversized data structures within a MODEL file, the parser fails to verify that write operations remain within the boundaries of the allocated memory buffer. This oversight allows controlled memory corruption that can be weaponized for code execution.

Attack Vector

Exploitation of CVE-2026-0875 requires an attacker to craft a malicious MODEL file containing specially formatted data designed to trigger the out-of-bounds write condition. The attack scenario typically involves:

1. An attacker creates a malicious MODEL file with carefully crafted payload data
2. The attacker delivers this file to a victim via email attachment, malicious download, or compromised file share
3. When the victim opens the file in a vulnerable Autodesk application, the parser processes the malicious data
4. The out-of-bounds write corrupts memory in a controlled manner
5. The attacker achieves code execution in the context of the current user process

The vulnerability requires user interaction (opening the malicious file), but no special privileges are needed beyond the ability to run the affected Autodesk application.

Detection Methods for CVE-2026-0875

Indicators of Compromise

• Unexpected crashes or application hangs when opening MODEL files from untrusted sources
• Unusual process behavior or child process spawning from Autodesk applications
• Memory access violations or error logs indicating buffer overflows in Autodesk software
• Suspicious MODEL files with abnormal file structure or unusually large embedded data sections

Detection Strategies

• Monitor Autodesk application processes for signs of exploitation such as unexpected memory exceptions or unusual child process creation
• Implement file integrity monitoring on MODEL files stored in shared network locations
• Deploy endpoint detection and response (EDR) solutions capable of detecting memory corruption exploitation techniques
• Create detection rules for anomalous behavior patterns in Autodesk processes, including suspicious API calls or shellcode execution indicators

Monitoring Recommendations

• Enable detailed logging for Autodesk applications to capture file access events and potential crash information
• Implement network monitoring to detect MODEL files being downloaded from untrusted external sources
• Configure SIEM rules to correlate MODEL file access with subsequent suspicious process behavior
• Monitor for unusual outbound network connections following MODEL file operations in Autodesk applications

How to Mitigate CVE-2026-0875

Immediate Actions Required

• Apply the latest security patches from Autodesk as referenced in Security Advisory ADSK-SA-2026-0004
• Restrict MODEL file access to trusted sources only and implement file source verification procedures
• Enable application sandboxing or virtualization for processing MODEL files from external sources
• Educate users about the risks of opening MODEL files from untrusted sources

Patch Information

Autodesk has released security updates to address this vulnerability. Administrators should consult the Autodesk Security Advisory ADSK-SA-2026-0004 for detailed patch information and download links. Organizations using Autodesk Access should ensure their subscription is current to receive the latest security updates.

Workarounds

• Implement strict email filtering to quarantine or block MODEL file attachments from external senders
• Configure group policies to prevent execution of Autodesk applications on MODEL files downloaded from the internet
• Use application control solutions to restrict MODEL file processing to designated secure workstations
• Consider using virtual machines or sandboxed environments for processing MODEL files from untrusted sources until patches are applied

# Example: Configure Windows to block MODEL files from untrusted zones
# Add MODEL files to the list of dangerous file extensions in Group Policy
# Group Policy Path: User Configuration > Administrative Templates > Windows Components > Attachment Manager
# Enable "Inclusion list for high risk file types" and add .model extension