CVE-2026-14478: Privilege Escalation Vulnerability

CVE-2026-14478 Overview

CVE-2026-14478 affects the Autodesk Open Data Interoperability Service (ODIS) installer. A local low-privileged attacker who executes a maliciously crafted executable on the victim's machine can inject unauthenticated inter-process communication (IPC) messages into named pipes. The attacker can also modify pipe permissions or ownership. Successful exploitation impacts the confidentiality, integrity, and availability of the affected system.

The root weakness is classified as [CWE-732] Incorrect Permission Assignment for Critical Resource. Autodesk documented the issue in security advisory ADSK-SA-2026-0013.

Critical Impact
A local low-privileged process can hijack ODIS named pipes to inject IPC traffic or reassign pipe ownership, enabling privilege escalation and full compromise of the host.

Affected Products

Autodesk ODIS (Open Data Interoperability Service) Installer
AdODIS-installer.exe distributions delivered through Autodesk's installer channel
Autodesk product installations that rely on the ODIS installer for setup and update workflows

Discovery Timeline

2026-08-12 - CVE-2026-14478 published to the National Vulnerability Database
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-14478

Vulnerability Analysis

The flaw exists in how the Autodesk ODIS installer creates and secures named pipes used for local IPC. Named pipes are Windows kernel objects that carry structured messages between processes. When the pipe's security descriptor grants overly permissive access to standard users, any local process can connect, send messages, or alter the pipe's discretionary access control list (DACL).

In this case, a low-privileged attacker who runs a crafted executable on the host can open the ODIS pipe endpoint and issue IPC calls without authentication. The attacker can also change the pipe's ownership, effectively removing the higher-privileged service's exclusive control over its own communication channel.

Because the ODIS installer runs with elevated rights during installation and update operations, injected IPC messages are processed in a trusted context. This turns a local, low-privileged foothold into a path for privilege escalation and arbitrary action against the installer service.

Root Cause

The root cause is incorrect permission assignment on the named pipe object [CWE-732]. The pipe is created with a security descriptor that permits low-privileged users to write messages and modify the pipe's DACL or owner, instead of restricting access to the ODIS service account.

Attack Vector

Exploitation requires local access and low privileges. No user interaction is required beyond execution of the attacker-supplied binary. The attacker enumerates ODIS named pipes, connects to the vulnerable endpoint, and either delivers unauthenticated IPC commands or invokes SetSecurityInfo style operations to seize ownership of the pipe. The Autodesk advisory ADSK-SA-2026-0013 documents the affected components. No public proof-of-concept exploit is currently available.

Detection Methods for CVE-2026-14478

Indicators of Compromise

Unexpected processes opening handles to Autodesk ODIS named pipes with GENERIC_WRITE or WRITE_DAC access rights
Changes to the owner or DACL of ODIS-related pipe objects that do not match the ODIS installer service account
Execution of unsigned or unfamiliar binaries in user-writable directories immediately preceding ODIS installer activity

Detection Strategies

Monitor Windows Sysmon Event ID 17 and 18 (pipe created and pipe connected) for ODIS pipe names accessed by non-Autodesk processes
Alert on SetSecurityInfo, SetNamedSecurityInfo, or SetKernelObjectSecurity calls that target named pipe objects owned by installer services
Correlate low-privileged process launches with subsequent elevated actions performed by the ODIS installer service

Monitoring Recommendations

Baseline the expected set of processes that legitimately communicate over Autodesk ODIS pipes and alert on deviations
Ingest endpoint process, file, and IPC telemetry into a central analytics platform to enable cross-host correlation
Track Autodesk installer service restarts and configuration changes that occur outside of scheduled maintenance windows

How to Mitigate CVE-2026-14478

Immediate Actions Required

Update the Autodesk ODIS installer to the version identified in Autodesk security advisory ADSK-SA-2026-0013
Restrict interactive and remote logon rights on systems that host Autodesk installation workflows to reduce local attack surface
Audit named pipe permissions on affected hosts and remove any non-default DACL entries that grant write access to standard users

Patch Information

Autodesk has published remediation guidance in Autodesk Security Advisory ADSK-SA-2026-0013. Administrators should download the current installer from the Autodesk ODIS Installer distribution endpoint and redeploy across affected endpoints.

Workarounds

Prevent execution of untrusted binaries on workstations that run the ODIS installer by enforcing application control policies such as Windows Defender Application Control or AppLocker
Remove or disable the ODIS installer service on hosts where it is not required for active Autodesk deployment tasks
Limit local user accounts on affected systems and require administrative approval for software installation workflows

bash

# Example: enumerate DACLs on Autodesk ODIS named pipes to spot excessive permissions
powershell -Command "Get-ChildItem \\.\pipe\ | Where-Object { $_.Name -like '*ODIS*' -or $_.Name -like '*Autodesk*' } | ForEach-Object { $_.Name; (Get-Acl \\.\pipe\$($_.Name)).Access }"