CVE-2025-1651
📋 TL;DR
A heap-based buffer overflow vulnerability in Autodesk AutoCAD allows attackers to craft malicious MODEL files that can crash the application, leak sensitive data, or execute arbitrary code when opened. This affects AutoCAD users who open untrusted MODEL files. The vulnerability requires user interaction to open a malicious file.
💻 Affected Systems
- Autodesk AutoCAD
- Autodesk AutoCAD LT
📦 What is this software?
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the AutoCAD process, potentially leading to full system compromise, data theft, or lateral movement.
Likely Case
Application crash or denial of service when opening malicious files, with potential for limited data leakage from memory.
If Mitigated
No impact if users only open trusted files from verified sources and have proper security controls.
🎯 Exploit Status
Exploitation requires crafting a malicious MODEL file and convincing a user to open it. No authentication bypass needed but requires user interaction.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Latest updates for AutoCAD 2022 and earlier (specific version numbers in vendor advisory)
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001
Restart Required: No
Instructions:
1. Open AutoCAD. 2. Navigate to Help > Check for Updates. 3. Download and install the latest security update. 4. Verify installation by checking version number.
🔧 Temporary Workarounds
Restrict MODEL file execution
allBlock or restrict opening of .model files from untrusted sources using application control or file extension policies.
User awareness training
allTrain users to only open MODEL files from trusted sources and verify file integrity before opening.
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized AutoCAD instances
- Use email filtering and web proxies to block malicious MODEL file attachments and downloads
🔍 How to Verify
Check if Vulnerable:
Check AutoCAD version against affected versions listed in Autodesk security advisory ADSK-SA-2025-0001Check Version:
In AutoCAD: Help > About AutoCAD > Product InformationVerify Fix Applied:
Verify AutoCAD version matches or exceeds the patched version specified in the vendor advisory📡 Detection & Monitoring
Log Indicators:
- Application crashes with heap corruption errors
- Unexpected AutoCAD process termination
- Security event logs showing file access to suspicious MODEL files
Network Indicators:
- Downloads of MODEL files from untrusted sources
- Network traffic patterns indicating data exfiltration after file opening
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName='acad.exe' AND (FaultModuleName LIKE '%heap%' OR ExceptionCode=0xC0000005)