EXPLOIT/ALERT Back to feed

Shared Components vulnerability

A maliciously crafted CATPRODUCT file, when parsed through certain Autodesk products, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

Published 15 Dec 2025Updated 17 Sep 20262 sources
CVSS 7.8
Overview Sources History

What happened

A maliciously crafted CATPRODUCT file, when parsed through certain Autodesk products, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

Affected versions

Shared Components: 1.8.0 through before 1.9.0 (semver); 2025.0.0 through before 2025.1.4 (semver); 2024.0.0 through before 2024.1.9 (semver) Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

  • Apply vendor-provided updates or mitigations.
  • Review affected product exposure and access logs.

Public PoC references

No public PoC reference has passed the current publication threshold.

CorrectionsReport an issue