CVE-2026-14255: Autodesk IFC Parser DOS Vulnerability

CVE-2026-14255 Overview

CVE-2026-14255 is an uncontrolled recursion vulnerability [CWE-674] affecting certain Autodesk products that parse Industry Foundation Classes (IFC) files. A maliciously crafted IFC file triggers unbounded recursive processing during parsing. The recursion exhausts stack resources and forces the application to terminate. Exploitation requires a local user to open the malicious file, making user interaction a prerequisite. The result is a denial-of-service condition against the affected Autodesk application. Autodesk documented the issue in security advisory ADSK-SA-2026-0015.

Critical Impact
Successful exploitation causes the affected Autodesk application to crash, producing a local denial-of-service against the user's workstation session and any unsaved work.

Affected Products

Autodesk products that process IFC files (see ADSK-SA-2026-0015 for the enumerated product and version list)
Autodesk Access is the recommended update delivery channel for affected desktop products
Specific affected product versions were not enumerated in the NVD record

Discovery Timeline

2026-09-02 - CVE-2026-14255 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-14255

Vulnerability Analysis

The flaw resides in Autodesk's IFC parser. IFC is a schema-driven, text-based file format used to describe building and construction data across CAD and BIM tools. The parser processes hierarchical entity references, and certain constructs are handled through recursive function calls. When an attacker crafts an IFC file with deeply nested or self-referential structures, the parser recurses without an effective depth limit. The recursion consumes the thread's stack until the process fails and terminates.

Because the parser executes inside the host Autodesk application, the crash takes down the entire product instance. Any unsaved model state is lost. The vulnerability does not expose data confidentiality or integrity, but availability is affected on the local host.

Root Cause

The root cause is a missing recursion depth check in the IFC parsing routines, categorized under CWE-674: Uncontrolled Recursion. The parser trusts the structural depth of attacker-supplied input and does not enforce a bounded stack budget or convert recursion to iteration for pathological inputs.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a crafted IFC file through email, shared project storage, a collaboration platform, or a supply chain of third-party models. The target opens the file in a vulnerable Autodesk product, and the parser recurses until the application terminates. No authentication or elevated privileges are required on the target host. Verified proof-of-concept code is not listed in the NVD record.

No verified exploit code is available. See the Autodesk advisory ADSK-SA-2026-0015 for technical details on the affected parser and vendor-supplied fixes.

Detection Methods for CVE-2026-14255

Indicators of Compromise

Repeated unexpected termination of Autodesk applications shortly after opening an IFC file
Windows Error Reporting or crash dump entries citing stack overflow in the IFC parsing module
IFC files delivered from untrusted sources exhibiting abnormally deep nesting or recursive entity references
Application event log entries showing the Autodesk process exiting with a stack exhaustion fault code

Detection Strategies

Hunt for process termination events on the Autodesk executable correlated with recent IFC file access
Inspect inbound IFC attachments and shared model files for pathological nesting depth before distribution
Correlate endpoint crash telemetry with file-open events to identify targeted delivery attempts

Monitoring Recommendations

Forward endpoint process, file, and crash telemetry to a centralized data lake for correlation across engineering workstations
Alert on clusters of Autodesk application crashes across multiple users receiving the same IFC file
Track IFC file provenance through email gateways and file-sharing services to identify the originating source

How to Mitigate CVE-2026-14255

Immediate Actions Required

Apply the fixed Autodesk product versions listed in advisory ADSK-SA-2026-0015 using Autodesk Access
Instruct users not to open IFC files received from untrusted or unverified sources
Inventory workstations running Autodesk products that consume IFC input and prioritize them for patching

Patch Information

Autodesk published remediation guidance in the Autodesk Security Advisory ADSK-SA-2026-0015. Deploy the fixed builds through Autodesk Access or the standard enterprise deployment process. Confirm the installed product version matches the fixed version referenced in the advisory.

Workarounds

Restrict IFC file intake to trusted project partners and validated model repositories until patches are deployed
Open untrusted IFC files only inside isolated virtual machines or sandboxed sessions where a crash does not affect production work
Save work frequently and enable auto-save in Autodesk products to limit data loss from unexpected termination

bash

# Verify installed Autodesk product version on Windows
reg query "HKLM\SOFTWARE\Autodesk\<ProductName>" /s | findstr /I "Version"

# Compare the returned version against the fixed version in ADSK-SA-2026-0015