CVE-2026-16465: AutoCAD Information Disclosure Flaw

CVE-2026-16465 Overview

CVE-2026-16465 is an out-of-bounds read vulnerability in Autodesk AutoCAD's DWG and DXF file parsing routines. An attacker crafts a malformed drawing file and delivers it to a target user. When AutoCAD parses the file, the application reads memory outside the intended buffer boundary. The condition maps to [CWE-125] Out-of-Bounds Read.

Successful exploitation can crash the application or disclose sensitive memory contents to the attacker. Exploitation requires local file handling and user interaction to open the crafted file. Autodesk published advisory ADSK-SA-2026-0009 covering this issue.

Critical Impact
A crafted DWG or DXF file can crash Autodesk AutoCAD and leak sensitive process memory when opened by a victim user.

Affected Products

Autodesk AutoCAD (DWG and DXF file parsers)
Autodesk DWG TrueView
Autodesk Access (advisory distribution component)

Discovery Timeline

2026-07-29 - CVE-2026-16465 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-16465

Vulnerability Analysis

The flaw resides in the parser that processes Autodesk DWG and DXF drawing files. The parser reads structured records containing offsets, lengths, and object references. When a crafted file supplies malformed size or index values, the parser reads past the end of an allocated buffer. This produces an out-of-bounds read into adjacent heap or stack memory.

The consequences are twofold. First, the invalid read can dereference unmapped memory and terminate the AutoCAD process, causing denial of service. Second, the read can return live memory contents to attacker-controlled logic inside the parser. That content may include pointers, file handles, or fragments of unrelated documents already loaded in the same session.

Exploitation is local and requires the victim to open the file. Autodesk classifies this as a client-side parsing bug rather than a network-reachable service issue.

Root Cause

The root cause is missing or insufficient bounds validation on length and offset fields inside DWG and DXF records. The parser trusts values supplied by the file rather than validating them against the actual allocation size before dereferencing pointers.

Attack Vector

An attacker builds a DWG or DXF file with manipulated header fields, object counts, or section lengths. The file is delivered through email, shared project repositories, cloud storage, or a supplier drawing exchange. When the user double-clicks the file or opens it inside AutoCAD, the parser hits the crafted record and performs the out-of-bounds read.

Code execution is not documented for this issue. The confirmed outcomes are process crash and information disclosure. See the Autodesk Security Advisory ADSK-SA-2026-0009 for vendor-specific technical detail.

Detection Methods for CVE-2026-16465

Indicators of Compromise

Unexpected acad.exe crashes with access violation exceptions logged in the Windows Application event log shortly after opening a .dwg or .dxf file.
DWG or DXF files arriving from untrusted senders, external suppliers, or unusual cloud share links.
Windows Error Reporting (WER) dumps referencing AutoCAD parser modules following the open of a specific drawing file.

Detection Strategies

Alert on process termination events for AutoCAD binaries correlated with recent file-open activity on DWG or DXF extensions.
Inspect email and file-share gateways for DWG and DXF attachments and route them through sandbox detonation before delivery.
Track child processes spawned by AutoCAD after opening drawing files to catch follow-on activity if the parser flaw is chained with other issues.

Monitoring Recommendations

Enable and forward Windows Error Reporting and application crash telemetry to your SIEM for AutoCAD hosts.
Baseline normal DWG and DXF open patterns per engineering workstation and flag deviations such as bulk opens from staging directories.
Monitor file provenance metadata (Zone.Identifier alternate data streams) on incoming drawing files to identify Internet-sourced content.

How to Mitigate CVE-2026-16465

Immediate Actions Required

Apply the fixed AutoCAD version identified in Autodesk Security Advisory ADSK-SA-2026-0009 on all engineering workstations.
Use Autodesk Access to inventory installed Autodesk products and confirm patch deployment status.
Instruct users to avoid opening DWG or DXF files from untrusted senders until patches are validated.

Patch Information

Autodesk published advisory ADSK-SA-2026-0009 with fixed versions for AutoCAD and related products. Administrators should distribute updates through Autodesk Access or standard software deployment tools. Users of Autodesk DWG TrueView should also update, since the vulnerable parser is shared across drawing viewers.

Workarounds

Open untrusted DWG and DXF files inside a disposable virtual machine or isolated sandbox until patching is complete.
Restrict AutoCAD from opening files sourced from Internet zones by enforcing Windows Attack Surface Reduction and Mark-of-the-Web policies.
Preview drawings through a controlled viewer on a low-privilege account rather than the primary engineering workstation.

bash

# Configuration example: block Mark-of-the-Web DWG/DXF files from launching AutoCAD without prompt
# PowerShell - enforce SmartScreen prompt on downloaded drawings
Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments' \
  -Name 'SaveZoneInformation' -Value 2 -Type DWord