CVE-2025-2497

A maliciously crafted DWG file, when parsed through Autodesk Revit, can cause a Stack-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.autodesk.com/products/autodesk-access/overview
https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0005	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:autodesk:revit::::::::
	cpe:2.3:a:autodesk:revit::::::::

History

No history.

Information

Published : 2025-04-15 21:15

Updated : 2025-08-19 14:15

NVD link : CVE-2025-2497

Mitre link : CVE-2025-2497

CVE.ORG link : CVE-2025-2497

JSON object : View

Products Affected

autodesk

revit

CWE

CWE-122

Heap-based Buffer Overflow

CWE-787

Out-of-bounds Write

{"id": "CVE-2025-2497", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2025-04-15T21:15:56.630", "references": [{"url": "https://www.autodesk.com/products/autodesk-access/overview", "source": "[email protected]"}, {"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0005", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-122"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A maliciously crafted DWG file, when parsed through Autodesk Revit, can cause a Stack-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."}, {"lang": "es", "value": "Un archivo DWG manipulado con fines maliciosos, al analizarse mediante Autodesk Revit, puede causar una vulnerabilidad de desbordamiento de b\u00fafer basado en pila. Un agente malicioso puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo arbitrario en el contexto del proceso actual."}], "lastModified": "2025-08-19T14:15:37.997", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F61D5DA-0CBA-4A14-8CD4-154FFE14E70C", "versionEndExcluding": "2024.3.2", "versionStartIncluding": "2024"}, {"criteria": "cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4229BAB4-AE43-43E3-89ED-1E19445482E1", "versionEndExcluding": "2025.4.1", "versionStartIncluding": "2025"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}