CVE-2026-1288 Overview
CVE-2026-1288 is a NULL Pointer Dereference vulnerability [CWE-476] in Autodesk Revit. The flaw is triggered when a maliciously crafted Revit Family (RFA) file is converted to FormIt using the Convert RFA to FormIt feature. Processing the malformed file causes the application to dereference a NULL pointer and crash, producing a denial-of-service condition. Exploitation requires local access and user interaction, since a victim must open and convert the attacker-supplied file. The issue does not impact confidentiality or integrity, only availability of the Revit process.
Critical Impact
A crafted RFA file triggers an application crash during FormIt conversion, leading to denial of service in Autodesk Revit.
Affected Products
- Autodesk Revit (see Autodesk Security Advisory ADSK-SA-2026-0007)
- Revit Convert RFA to FormIt workflow
- Environments managed via Autodesk Access
Discovery Timeline
- 2026-06-17 - CVE-2026-1288 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-1288
Vulnerability Analysis
The vulnerability resides in the RFA-to-FormIt conversion path inside Autodesk Revit. When Revit parses an attacker-controlled RFA file during the Convert RFA to FormIt operation, the parser fails to validate an internal pointer before dereferencing it. The dereference of an uninitialized or unset pointer causes an access violation and terminates the host process. Because the attack vector is local and requires the user to open the file and initiate the conversion, the flaw cannot be triggered remotely without user action. The impact is limited to availability: Revit terminates, unsaved work is lost, and the conversion workflow becomes unusable until the malicious file is removed.
Root Cause
The root cause is missing pointer validation in the RFA parsing routines invoked by the FormIt conversion logic. Object or structure pointers derived from attacker-controlled file fields are used without first verifying they reference allocated memory, matching the pattern described by CWE-476.
Attack Vector
An attacker crafts an RFA file with malformed structures that cause the conversion routine to compute or retrieve a NULL pointer. The attacker delivers the file through email, shared project storage, or a collaboration platform. When a Revit user runs Convert RFA to FormIt against the file, Revit dereferences the NULL pointer and crashes. No verified proof-of-concept code is published; refer to the Autodesk Security Advisory ADSK-SA-2026-0007 for vendor technical details.
Detection Methods for CVE-2026-1288
Indicators of Compromise
- Unexpected termination of Revit.exe shortly after a user initiates the Convert RFA to FormIt action.
- Windows Application event log entries referencing an access violation (exception code 0xC0000005) in Revit modules.
- Presence of untrusted RFA files sourced from email attachments, external shares, or unknown collaborators.
Detection Strategies
- Monitor for repeated Revit process crashes correlated with the opening of RFA files from non-corporate paths.
- Inspect Windows Error Reporting (WER) artifacts under %LOCALAPPDATA%\CrashDumps for Revit minidumps that reference NULL address dereferences.
- Flag inbound RFA files that fail integrity checks or originate outside approved BIM collaboration platforms.
Monitoring Recommendations
- Centralize Revit application crash telemetry and alert on bursts affecting multiple workstations.
- Track file provenance for RFA files entering engineering workstations through email gateways and file shares.
- Review Autodesk Access update status across endpoints to confirm Revit components remain at supported, patched versions.
How to Mitigate CVE-2026-1288
Immediate Actions Required
- Apply the Autodesk-provided updates referenced in ADSK-SA-2026-0007 as soon as they are available for your Revit release.
- Restrict the Convert RFA to FormIt workflow to RFA files from trusted, internal sources only.
- Educate Revit users to avoid opening or converting RFA files received from unverified parties.
Patch Information
Autodesk publishes fixed builds and update guidance through Autodesk Access and the security advisory ADSK-SA-2026-0007. Consult the advisory for the specific Revit versions and hotfix builds that address the NULL pointer dereference in the RFA-to-FormIt converter.
Workarounds
- Avoid using Convert RFA to FormIt on RFA files of unknown origin until patched builds are deployed.
- Quarantine RFA files received from external senders and validate them in an isolated environment before conversion.
- Enforce least privilege on engineering workstations so a Revit crash does not affect shared infrastructure or project storage.
# Configuration example: verify Autodesk Access has Revit updates pending
"%ProgramFiles%\Autodesk\AdODIS\V1\Installer.exe" /listupdates
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
