CVE-2025-10889
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code by tricking users into opening malicious CATPART files in affected Autodesk products. Memory corruption occurs during file parsing, enabling code execution within the current process context. Users of vulnerable Autodesk software are affected.
💻 Affected Systems
- Autodesk Access
- Other Autodesk products that parse CATPART files
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation or malware installation when users open malicious files, potentially leading to credential theft or data exfiltration.
If Mitigated
Limited impact with proper application sandboxing and user awareness preventing file execution.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file); no public exploit code identified in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Autodesk advisory ADSK-SA-2025-0024 for specific patched versions
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0024
Restart Required: Yes
Instructions:
1. Review Autodesk advisory ADSK-SA-2025-0024
2. Identify affected products and versions
3. Update to patched versions via Autodesk Access or official channels
4. Restart applications after update
🔧 Temporary Workarounds
Block CATPART file extensions
windowsPrevent execution of CATPART files via group policy or endpoint protection
User awareness training
allEducate users to avoid opening CATPART files from untrusted sources
🧯 If You Can't Patch
- Implement application whitelisting to restrict execution of vulnerable Autodesk products
- Deploy endpoint detection and response (EDR) solutions to monitor for suspicious file parsing behavior
🔍 How to Verify
Check if Vulnerable:
Check installed Autodesk product versions against patched versions in advisory ADSK-SA-2025-0024Check Version:
Check via Autodesk product 'About' menu or consult product documentation for version checkingVerify Fix Applied:
Confirm installed version matches or exceeds patched version specified in vendor advisory📡 Detection & Monitoring
Log Indicators:
- Unexpected process crashes in Autodesk applications
- Suspicious file parsing events in application logs
Network Indicators:
- Unusual outbound connections from Autodesk processes post-file opening
SIEM Query:
Process creation events where parent process is Autodesk executable and command line contains CATPART file paths