CVE-2025-1431
📋 TL;DR
This vulnerability allows attackers to exploit an out-of-bounds read in Autodesk AutoCAD when processing malicious SLDPRT files. Successful exploitation could lead to application crashes, sensitive data disclosure, or arbitrary code execution. Users of affected AutoCAD versions are at risk.
💻 Affected Systems
- Autodesk AutoCAD
- Autodesk AutoCAD LT
📦 What is this software?
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the same privileges as the AutoCAD process, potentially leading to full system compromise.
Likely Case
Application crashes and denial of service, with potential for limited data disclosure.
If Mitigated
No impact if malicious files are blocked or patched versions are used.
🎯 Exploit Status
Exploitation requires user interaction to open malicious file. No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Latest AutoCAD 2022 updates (check specific version in vendor advisory)
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001
Restart Required: No
Instructions:
1. Open AutoCAD. 2. Navigate to Help > Check for Updates. 3. Install all available updates. 4. Verify installation by checking version.
🔧 Temporary Workarounds
Block SLDPRT files
allConfigure email/web filters to block SLDPRT attachments and downloads
User awareness training
allTrain users not to open SLDPRT files from untrusted sources
🧯 If You Can't Patch
- Restrict AutoCAD usage to trusted users only
- Implement application whitelisting to prevent unauthorized AutoCAD execution
🔍 How to Verify
Check if Vulnerable:
Check AutoCAD version against vendor advisory. If using AutoCAD 2022 without latest updates, assume vulnerable.Check Version:
In AutoCAD: Help > About AutoCADVerify Fix Applied:
Verify AutoCAD version matches or exceeds patched version specified in vendor advisory.📡 Detection & Monitoring
Log Indicators:
- AutoCAD crash logs
- Application error events in Windows Event Viewer
Network Indicators:
- Downloads of SLDPRT files from untrusted sources
SIEM Query:
EventID=1000 AND ProcessName='acad.exe' OR FileExtension='.sldprt' AND Action='Download'