High severity · published Oct 27, 2026
CVE-2026-113775
Dynamic Library Loading Process Control in Autodesk Fusion Desktop
New
7.8
CVSS
0.1%
EPSS
No
On KEV
Description
A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can trigger an Exposed Dangerous Function vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FU
Fusion · Autodesk
2705.1.30 before 2706.1.14 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-113775
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-113775
dl.appstreaming.autodesk.com
https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg
dl.appstreaming.autodesk.com
https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe
www.autodesk.com
https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0019
More from Fusion
9.6
CVE-2026-10789
MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop
8.7
CVE-2025-10244
HTML Payload Stored Cross-Site Scripting (XSS) Vulnerability
8.6
CVE-2026-85217
Man-in-the-Middle (MITM) Vulnerability in Autodesk Fusion Desktop
8.1
CVE-2026-0535
Stored XSS in Electronic Library Component Description
8.1
CVE-2026-0534
Stored XSS in the value of a part attribute