CVE-2026-16463: AutoCAD Buffer Overflow Vulnerability

CVE-2026-16463 Overview

CVE-2026-16463 is a heap-based buffer overflow vulnerability [CWE-122] affecting Autodesk AutoCAD when parsing maliciously crafted Drawing Exchange Format (DXF) files. An attacker who convinces a user to open a specially crafted DXF file can trigger memory corruption in the AutoCAD process. Successful exploitation can crash the application, disclose sensitive process memory, or execute arbitrary code with the privileges of the current user. The flaw requires local file access and user interaction, but no authentication is needed. Autodesk published advisory ADSK-SA-2026-0009 addressing the issue.

Critical Impact
Opening a malicious DXF file in AutoCAD can lead to arbitrary code execution in the context of the current user, enabling attacker persistence and lateral movement on engineering workstations.

Affected Products

Autodesk AutoCAD (see ADSK-SA-2026-0009 for affected versions)
Autodesk products that share the DXF parsing component
Autodesk DWG TrueView (referenced in vendor advisory scope)

Discovery Timeline

2026-07-29 - CVE-2026-16463 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-16463

Vulnerability Analysis

The vulnerability resides in the DXF file parsing routines used by Autodesk AutoCAD. DXF is an ASCII and binary interchange format representing drawing data as group code and value pairs. When AutoCAD parses attacker-controlled records inside a crafted DXF file, insufficient bounds checking allows data to be written past the boundary of a heap-allocated buffer. The resulting corruption can overwrite adjacent heap metadata, object pointers, or function pointers referenced later by the application. An attacker who controls the corrupted memory contents can pivot from a memory-safety fault into arbitrary code execution inside the AutoCAD process.

Root Cause

The root cause is a classic heap-based buffer overflow [CWE-122] in the DXF parser. Length values embedded within the DXF stream are trusted without validation against the size of the destination heap buffer. Because DXF records can drive allocation sizes and copy lengths independently, an attacker can craft field values that cause the parser to copy more data than the allocated region holds. This mismatch between declared and validated lengths is the underlying defect.

Attack Vector

Exploitation requires local file access and user interaction. A user must open the malicious DXF file with AutoCAD, either directly or through an embedded reference in a project or archive. Typical delivery paths include phishing emails with DXF attachments, shared engineering drives, contractor deliverables, and supply chain drops that replace legitimate design files. Because AutoCAD workstations often store intellectual property and connect to engineering networks, code execution on these hosts is a high-value foothold. Refer to the Autodesk Security Advisory ADSK-SA-2026-0009 for technical scope.

Detection Methods for CVE-2026-16463

Indicators of Compromise

Unexpected AutoCAD process crashes with access violation exceptions immediately after opening DXF files
DXF files originating from untrusted external sources placed in engineering shared drives
AutoCAD spawning child processes such as cmd.exe, powershell.exe, or rundll32.exe
Outbound network connections from acad.exe to non-Autodesk infrastructure following DXF file open events

Detection Strategies

Alert on child process creation from acad.exe or related Autodesk executables, since AutoCAD rarely launches shells or scripting hosts under normal use
Monitor for AutoCAD process memory anomalies and Windows Error Reporting entries referencing heap corruption
Inspect DXF files entering the environment for oversized group code values and malformed record structures

Monitoring Recommendations

Collect endpoint telemetry from workstations running Autodesk products and correlate file open events with process behavior
Track file provenance for DXF and DWG files delivered by email, cloud storage, or contractor uploads
Ingest Windows Application event logs and crash dumps from CAD workstations into a centralized data lake for retrospective hunting

How to Mitigate CVE-2026-16463

Immediate Actions Required

Apply the fixed AutoCAD build referenced in Autodesk Security Advisory ADSK-SA-2026-0009 as soon as it is available for your version track
Use Autodesk Access to inventory installed Autodesk products and push the vendor-supplied update
Restrict opening of DXF files sourced from outside the organization until patched builds are deployed
Instruct engineering users to validate the origin of DXF and DWG deliverables before opening them

Patch Information

Autodesk has published advisory ADSK-SA-2026-0009 with fixed versions of AutoCAD and related products. Administrators should map installed versions against the advisory matrix and roll out the vendor-supplied installers. Users of DWG TrueView should verify whether their build is listed as affected and update accordingly.

Workarounds

Block inbound DXF attachments at the email gateway pending patch deployment
Open untrusted DXF files only on isolated, non-privileged review workstations without network access to sensitive resources
Run AutoCAD under a standard user account with application-level allowlisting to limit the impact of code execution
Enforce Windows exploit mitigations such as Control Flow Guard and Data Execution Prevention on AutoCAD binaries

bash

# Configuration example: block DXF files at a Windows file share using File Server Resource Manager
New-FsrmFileGroup -Name "UntrustedCAD" -IncludePattern @("*.dxf")
New-FsrmFileScreen -Path "D:\Shares\Inbound" -IncludeGroup "UntrustedCAD" -Active $true