CVE-2025-5039: Privilege Ecalation due to Untrusted Search Path Vulnerability

Description

A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context of the current process due to an untrusted search path being utilized.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 11% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

3M

3ds Max · Autodesk

2027 before 2027.1; 2026 before 2026.3.3 · source: vendor

AU

AutoCAD · Autodesk

2026 before 2026.1 · source: vendor

AL

AutoCAD LT · Autodesk

2026 before 2026.1 · source: vendor

RE

RealDWG · Autodesk

2026 before 2026.0.2 · source: vendor

IP

Infrastructure Parts Editor · Autodesk