ZDI-CAN-27974: ZDI-25-1111: Autodesk AutoCAD CATPRODUCT File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Published Dec 17, 2025

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autodesk AutoCAD. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-10883.

Affected Software

1 affected component

Autodesk AutoCAD

Event History

Dec 17, 2025

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-27974?

ZDI-CAN-27974 has a CVSS rating indicating it's a critical vulnerability that can lead to remote code execution.

How do I fix ZDI-CAN-27974?

To fix ZDI-CAN-27974, update your Autodesk AutoCAD installation to the latest version that addresses this vulnerability.

What are the risks associated with ZDI-CAN-27974?

Exploiting ZDI-CAN-27974 allows remote attackers to execute arbitrary code on the affected installations, which can compromise user data and system integrity.

What versions of AutoCAD are affected by ZDI-CAN-27974?

ZDI-CAN-27974 affects all vulnerable versions of Autodesk AutoCAD that have not been patched.

What type of exploitation is needed for ZDI-CAN-27974?

ZDI-CAN-27974 requires user interaction, such as visiting a malicious webpage or opening a harmful file.