CVE-2025-1428 - Vulnerability Details

- CATPRODUCT File Parsing Out-of-Bounds Read Vulnerability

Description

A maliciously crafted CATPART file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

Published: 2025-03-13

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Autodesk

AutoCAD

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.2
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

AutoCAD Architecture

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.2
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

AutoCAD Electrical

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.2
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

AutoCAD Mechanical

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.2
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

AutoCAD MEP

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.2
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

AutoCAD Plant 3D

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.2
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

Civil 3D

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.2
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

Advance Steel

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.2
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

AutoCAD MAP 3D

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.2
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Configuration 1 [-]

OR	cpe:2.3:a:autodesk:autocad::::::::
	cpe:2.3:a:autodesk:autocad::::::::
	cpe:2.3:a:autodesk:autocad::::::::
	cpe:2.3:a:autodesk:autocad::::::::

Configuration 2 [-]

OR	cpe:2.3:a:autodesk:autocad_architecture::::::::
	cpe:2.3:a:autodesk:autocad_architecture::::::::
	cpe:2.3:a:autodesk:autocad_architecture::::::::
	cpe:2.3:a:autodesk:autocad_architecture::::::::

Configuration 3 [-]

OR	cpe:2.3:a:autodesk:autocad_electrical::::::::
	cpe:2.3:a:autodesk:autocad_electrical::::::::
	cpe:2.3:a:autodesk:autocad_electrical::::::::
	cpe:2.3:a:autodesk:autocad_electrical::::::::

Configuration 4 [-]

OR	cpe:2.3:a:autodesk:autocad_mechanical::::::::
	cpe:2.3:a:autodesk:autocad_mechanical::::::::
	cpe:2.3:a:autodesk:autocad_mechanical::::::::
	cpe:2.3:a:autodesk:autocad_mechanical::::::::

Configuration 5 [-]

OR	cpe:2.3:a:autodesk:autocad_mep::::::::
	cpe:2.3:a:autodesk:autocad_mep::::::::
	cpe:2.3:a:autodesk:autocad_mep::::::::
	cpe:2.3:a:autodesk:autocad_mep::::::::

Configuration 6 [-]

OR	cpe:2.3:a:autodesk:autocad_plant_3d::::::::
	cpe:2.3:a:autodesk:autocad_plant_3d::::::::
	cpe:2.3:a:autodesk:autocad_plant_3d::::::::
	cpe:2.3:a:autodesk:autocad_plant_3d::::::::

Configuration 7 [-]

OR	cpe:2.3:a:autodesk:civil_3d::::::::
	cpe:2.3:a:autodesk:civil_3d::::::::
	cpe:2.3:a:autodesk:civil_3d::::::::
	cpe:2.3:a:autodesk:civil_3d::::::::

Configuration 8 [-]

OR	cpe:2.3:a:autodesk:advance_steel::::::::
	cpe:2.3:a:autodesk:advance_steel::::::::
	cpe:2.3:a:autodesk:advance_steel::::::::
	cpe:2.3:a:autodesk:advance_steel::::::::

Configuration 9 [-]

OR	cpe:2.3:a:autodesk:autocad_map_3d::::::::
	cpe:2.3:a:autodesk:autocad_map_3d::::::::
	cpe:2.3:a:autodesk:autocad_map_3d::::::::
	cpe:2.3:a:autodesk:autocad_map_3d::::::::

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2025-6382	A maliciously crafted CATPART file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00379.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.autodesk.com/products/autodesk-access/overview
https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Where-can-I-download-the-latest-update-of-AutoCAD-AutoCAD-LT-2022.html
https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001

History

Tue, 19 Aug 2025 13:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Autodesk autocad Lt
CPEs		cpe:2.3:a:autodesk:advance_steel:2022:::::::* cpe:2.3:a:autodesk:advance_steel:2023:::::::* cpe:2.3:a:autodesk:advance_steel:2024:::::::* cpe:2.3:a:autodesk:advance_steel:2025:::::::* cpe:2.3:a:autodesk:autocad_architecture:2022:::::::* cpe:2.3:a:autodesk:autocad_architecture:2023:::::::* cpe:2.3:a:autodesk:autocad_architecture:2024:::::::* cpe:2.3:a:autodesk:autocad_architecture:2025:::::::* cpe:2.3:a:autodesk:autocad_electrical:2022:::::::* cpe:2.3:a:autodesk:autocad_electrical:2023:::::::* cpe:2.3:a:autodesk:autocad_electrical:2024:::::::* cpe:2.3:a:autodesk:autocad_electrical:2025:::::::* cpe:2.3:a:autodesk:autocad_lt:2022:::::::* cpe:2.3:a:autodesk:autocad_lt:2023:::::::* cpe:2.3:a:autodesk:autocad_lt:2024:::::::* cpe:2.3:a:autodesk:autocad_lt:2025:::::::* cpe:2.3:a:autodesk:autocad_map_3d:2022:::::::* cpe:2.3:a:autodesk:autocad_map_3d:2023:::::::* cpe:2.3:a:autodesk:autocad_map_3d:2024:::::::* cpe:2.3:a:autodesk:autocad_map_3d:2025:::::::* cpe:2.3:a:autodesk:autocad_mechanical:2022:::::::* cpe:2.3:a:autodesk:autocad_mechanical:2023:::::::* cpe:2.3:a:autodesk:autocad_mechanical:2024:::::::* cpe:2.3:a:autodesk:autocad_mechanical:2025:::::::* cpe:2.3:a:autodesk:autocad_mep:2022:::::::* cpe:2.3:a:autodesk:autocad_mep:2023:::::::* cpe:2.3:a:autodesk:autocad_mep:2024:::::::* cpe:2.3:a:autodesk:autocad_mep:2025:::::::* cpe:2.3:a:autodesk:autocad_plant_3d:2022:::::::* cpe:2.3:a:autodesk:autocad_plant_3d:2023:::::::* cpe:2.3:a:autodesk:autocad_plant_3d:2024:::::::* cpe:2.3:a:autodesk:autocad_plant_3d:2025:::::::* cpe:2.3:a:autodesk:civil_3d:2022:::::::* cpe:2.3:a:autodesk:civil_3d:2023:::::::* cpe:2.3:a:autodesk:civil_3d:2024:::::::* cpe:2.3:a:autodesk:civil_3d:2025:::::::*
Vendors & Products		Autodesk autocad Lt
References		https://www.autodesk.com/products/autodesk-access/overview https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Where-can-I-download-the-latest-update-of-AutoCAD-AutoCAD-LT-2022.html

Sun, 13 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00029}`	epss `{'score': 0.00044}`

Thu, 08 May 2025 16:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Autodesk Autodesk advance Steel Autodesk autocad Autodesk autocad Architecture Autodesk autocad Electrical Autodesk autocad Map 3d Autodesk autocad Mechanical Autodesk autocad Mep Autodesk autocad Plant 3d Autodesk civil 3d
CPEs		cpe:2.3:a:autodesk:advance_steel:::::::: cpe:2.3:a:autodesk:autocad:::::::: cpe:2.3:a:autodesk:autocad_architecture:::::::: cpe:2.3:a:autodesk:autocad_electrical:::::::: cpe:2.3:a:autodesk:autocad_map_3d:::::::: cpe:2.3:a:autodesk:autocad_mechanical:::::::: cpe:2.3:a:autodesk:autocad_mep:::::::: cpe:2.3:a:autodesk:autocad_plant_3d:::::::: cpe:2.3:a:autodesk:civil_3d::::::::
Vendors & Products		Autodesk Autodesk advance Steel Autodesk autocad Autodesk autocad Architecture Autodesk autocad Electrical Autodesk autocad Map 3d Autodesk autocad Mechanical Autodesk autocad Mep Autodesk autocad Plant 3d Autodesk civil 3d

Fri, 04 Apr 2025 14:30:00 +0000

Type	Values Removed	Values Added
Description	A maliciously crafted CATPART file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.	A maliciously crafted CATPART file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Title	CATPRODUCT File Parsing Out-of-bounds Read Vulnerability	CATPRODUCT File Parsing Out-of-Bounds Read Vulnerability

Fri, 04 Apr 2025 13:15:00 +0000

Type	Values Removed	Values Added
Description	A maliciously crafted CATPART file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.	A maliciously crafted CATPART file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Title	CATPRODUCT File Parsing Out-of-Bounds Read Vulnerability	CATPRODUCT File Parsing Out-of-bounds Read Vulnerability

Thu, 13 Mar 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 13 Mar 2025 17:00:00 +0000

Type	Values Removed	Values Added
Description		A maliciously crafted CATPART file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Title		CATPRODUCT File Parsing Out-of-Bounds Read Vulnerability
Weaknesses		CWE-125
References		https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`

Subscriptions

Autodesk Advance Steel Autocad Autocad Architecture Autocad Electrical Autocad Lt Autocad Map 3d Autocad Mechanical Autocad Mep Autocad Plant 3d Civil 3d

MITRE

Status: PUBLISHED

Assigner: autodesk

Published: 2025-03-13T16:46:22.348Z

Updated: 2026-02-26T19:09:34.702Z

Reserved: 2025-02-18T14:22:12.740Z

Link: CVE-2025-1428

Vulnrichment

Updated: 2025-03-13T18:59:25.515Z

NVD

Status : Modified

Published: 2025-03-13T17:15:34.900

Modified: 2025-08-19T13:15:40.493

Link: CVE-2025-1428

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-125

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object