ZDI-CAN-25951: ZDI-25-158: Autodesk AutoCAD CATProduct File Parsing Uninitialized Variable Remote Code Execution Vulnerability

Published Mar 18, 2025

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autodesk AutoCAD. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-1650.

Affected Software

1 affected component

Autodesk AutoCAD

Event History

Mar 18, 2025

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-25951?

ZDI-CAN-25951 has been assigned a CVSS rating which indicates a high severity level due to its potential for remote code execution.

How do I fix ZDI-CAN-25951?

To fix ZDI-CAN-25951, ensure that you update Autodesk AutoCAD to the latest version provided by Autodesk.

What software is affected by ZDI-CAN-25951?

ZDI-CAN-25951 affects Autodesk AutoCAD 2024 installations.

What types of attacks are possible with ZDI-CAN-25951?

ZDI-CAN-25951 enables remote attackers to execute arbitrary code on the affected systems after user interaction.

Is user interaction required to exploit ZDI-CAN-25951?

Yes, user interaction is necessary as the target must visit a malicious page or open a malicious file to exploit ZDI-CAN-25951.