Out-of-bounds read in Autodesk products - CVE-2026-16465
Published: July 29, 2026 / Updated: July 30, 2026
Vulnerability identifier: #VU140567
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-16465
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
Autodesk AutoCAD
AutoCAD Architecture
AutoCAD Electrical
AutoCAD Mechanical
AutoCAD MEP
AutoCAD Plant 3D
Autodesk Civil 3D
Advance Steel
AutoCAD Map 3D
AutoCAD LT
DWG Trueview
Autodesk AutoCAD
AutoCAD Architecture
AutoCAD Electrical
AutoCAD Mechanical
AutoCAD MEP
AutoCAD Plant 3D
Autodesk Civil 3D
Advance Steel
AutoCAD Map 3D
AutoCAD LT
DWG Trueview
Detailed vulnerability description
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to out-of-bounds read in the DWG and DXF file parser when parsing a crafted DWG or DXF file. A remote attacker can supply a specially crafted file to disclose sensitive information.
User interaction is required to open or parse the crafted file.
How to mitigate CVE-2026-16465
Install security update from vendor's website.