CVE-2026-14479: Autodesk Installer DoS Vulnerability

CVE-2026-14479 Overview

CVE-2026-14479 affects the Autodesk Installer IPC frame parser. The vulnerability stems from improper validation of an input-specified position or offset [CWE-1285], which triggers an out-of-range substring operation when the parser processes maliciously crafted input.

A local attacker with low privileges can exploit this flaw to terminate the NT AUTHORITY\SYSTEM service unexpectedly. The result is a denial-of-service condition on the affected host. The issue does not expose confidentiality or integrity, but it disrupts the availability of the SYSTEM-level installer service.

Critical Impact
A local attacker can crash the Autodesk Installer service running as NT AUTHORITY\SYSTEM, producing a denial-of-service condition without any user interaction.

Affected Products

Autodesk ODIS Installer (AdODIS-installer.exe)
Autodesk Installer components exposing the IPC frame parser
See Autodesk Security Advisory ADAS-2026-0013 for the authoritative product and version list

Discovery Timeline

2026-08-12 - CVE CVE-2026-14479 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-14479

Vulnerability Analysis

The Autodesk Installer uses an inter-process communication (IPC) channel to exchange frame-structured messages between components. The frame parser reads position and offset values directly from attacker-controllable input. It then passes those values to a substring operation without validating them against the actual bounds of the source buffer.

When an offset or length exceeds the buffer size, the substring operation reads beyond the allocated range. This condition raises an unhandled exception inside the SYSTEM-privileged installer process, forcing it to terminate. The Common Weakness Enumeration classifies this pattern as improper validation of specified index, position, or offset in input [CWE-1285].

Because the affected service runs as NT AUTHORITY\SYSTEM, its abrupt termination interrupts installer operations, pending updates, and any component that depends on the IPC endpoint. The impact is limited to availability; the flaw does not permit code execution or data disclosure based on the current Autodesk advisory.

Root Cause

The root cause is missing bounds validation on an input-controlled index within the IPC frame parser. The parser trusts the position or offset field embedded in the frame and applies it to a substring routine without confirming that the value falls within the buffer length.

Attack Vector

Exploitation requires local access with low privileges. The attacker connects to the Autodesk Installer IPC endpoint and sends a crafted frame whose position or offset field points outside the message payload. No user interaction is required. The vulnerability manifests as an unhandled out-of-range condition inside the SYSTEM service, which then terminates.

No public proof-of-concept exploit is available at the time of publication. Refer to the Autodesk Security Advisory ADAS-2026-0013 for vendor-supplied technical detail.

Detection Methods for CVE-2026-14479

Indicators of Compromise

Unexpected termination events for the Autodesk Installer service or AdODIS-installer.exe process running under NT AUTHORITY\SYSTEM.
Windows Application or System event log entries recording an unhandled exception in the Autodesk installer binary.
Repeated crash-and-restart cycles of the Autodesk Installer IPC endpoint on a single host.

Detection Strategies

Monitor Windows Event ID 1000 (application crash) and Event ID 7031/7034 (service unexpectedly terminated) filtered for Autodesk installer components.
Correlate local process activity that opens the Autodesk Installer IPC endpoint immediately before a service crash.
Baseline the normal lifetime of AdODIS-installer.exe and alert on abnormal short-lived executions or repeated relaunches.

Monitoring Recommendations

Forward Windows event logs and endpoint process telemetry to a centralized SIEM for correlation across hosts.
Track user sessions with low-privilege local access that interact with the Autodesk installer service, especially on shared workstations.
Alert on any Windows Error Reporting entries referencing Autodesk installer binaries.

How to Mitigate CVE-2026-14479

Immediate Actions Required

Inventory endpoints that have the Autodesk ODIS Installer or related Autodesk installer components deployed.
Apply the patched installer version referenced in Autodesk Security Advisory ADAS-2026-0013 as soon as it is available in your change window.
Restrict interactive and remote local logon on systems running the Autodesk installer service to trusted administrators only.

Patch Information

Autodesk has published guidance under advisory ADAS-2026-0013. Download the current installer from the Autodesk ODIS Installer distribution point and follow the advisory to determine fixed versions for each affected product line.

Workarounds

Limit local user accounts on systems where the Autodesk installer service is active, reducing the pool of accounts that can reach the IPC endpoint.
Disable or stop the Autodesk installer service when it is not actively required for deployments or updates.
Enforce application allowlisting to prevent unauthorized local binaries from interacting with the installer IPC channel.

bash

# Configuration example: query and stop the Autodesk installer service on Windows
sc.exe query "AdODIS"
sc.exe stop  "AdODIS"
# Re-enable only when performing authorized installs or updates
sc.exe start "AdODIS"