CVE-2025-1659
📋 TL;DR
This vulnerability in Autodesk Navisworks allows attackers to exploit an out-of-bounds read by tricking users into opening a malicious DWFX file, potentially leading to crashes, data leaks, or arbitrary code execution. It affects users of Autodesk Navisworks who process untrusted DWFX files. The risk is highest for organizations using Navisworks for design review without proper security controls.
💻 Affected Systems
- Autodesk Navisworks
📦 What is this software?
Navisworks by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Arbitrary code execution in the context of the current process, allowing full system compromise or data exfiltration.
Likely Case
Application crash or sensitive data disclosure due to out-of-bounds read, disrupting workflows.
If Mitigated
Limited impact with proper patching and user awareness, reducing exposure to malicious files.
🎯 Exploit Status
Exploitation depends on social engineering to deliver malicious files; no public exploits confirmed yet.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to Autodesk advisory ADSK-SA-2025-0002 for patched versions.
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0002
Restart Required: Yes
Instructions:
1. Visit the Autodesk advisory URL. 2. Download and apply the latest patch for Navisworks. 3. Restart the application and system as required.
🔧 Temporary Workarounds
Block DWFX file processing
windowsPrevent Navisworks from opening DWFX files by adjusting file associations or using application controls.
Use Windows Group Policy to disable .dwfx file handling in Navisworks.
🧯 If You Can't Patch
- Restrict user permissions to limit file execution and use application whitelisting.
- Educate users to avoid opening untrusted DWFX files and implement email filtering for attachments.
🔍 How to Verify
Check if Vulnerable:
Check Navisworks version against the patched list in Autodesk advisory ADSK-SA-2025-0002.Check Version:
In Navisworks, go to Help > About to view the version details.Verify Fix Applied:
Confirm version is updated to the patched release specified in the advisory.📡 Detection & Monitoring
Log Indicators:
- Application crashes or errors related to DWFX file parsing in Navisworks logs.
Network Indicators:
- Unusual file downloads or email attachments with .dwfx extension.
SIEM Query:
Search for event logs with 'Navisworks' and 'crash' or 'error' near file access events.