CVE-2025-10899
📋 TL;DR
This CVE describes an out-of-bounds write vulnerability in Autodesk products when parsing malicious MODEL files. Attackers can exploit this to crash applications, corrupt data, or execute arbitrary code with the privileges of the current process. Users of affected Autodesk software are at risk.
💻 Affected Systems
- Autodesk Access
- Other Autodesk products mentioned in advisory
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crashes and denial of service affecting productivity workflows.
If Mitigated
Limited impact with proper network segmentation and file validation controls.
🎯 Exploit Status
Exploitation requires user interaction to open malicious files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version specified in ADSK-SA-2025-0024 advisory
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0024
Restart Required: Yes
Instructions:
1. Visit the Autodesk Trust Center advisory
2. Download and install the latest version of affected software
3. Restart the application and system if required
🔧 Temporary Workarounds
Restrict MODEL file processing
allBlock or restrict processing of untrusted MODEL files through application controls.
Network segmentation
allIsolate Autodesk workstations from critical networks.
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized execution
- Use email/web gateways to block malicious MODEL file attachments
🔍 How to Verify
Check if Vulnerable:
Check installed Autodesk software version against advisory ADSK-SA-2025-0024Check Version:
Check via Autodesk product 'About' dialog or system informationVerify Fix Applied:
Confirm software version matches or exceeds patched version in advisory📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected process termination of Autodesk software
Network Indicators:
- Unusual outbound connections from Autodesk processes
SIEM Query:
Process:autodesk* AND (EventID:1000 OR ExceptionCode:c0000005)