CVE-2025-6637
📋 TL;DR
CVE-2025-6637 is an out-of-bounds write vulnerability in Autodesk products that allows arbitrary code execution when parsing malicious PRT files. Attackers can exploit this to crash applications, corrupt data, or execute code with the privileges of the current user. Users of affected Autodesk software are at risk.
💻 Affected Systems
- Autodesk Access
- Other Autodesk products that parse PRT files
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data theft, or ransomware deployment.
Likely Case
Application crashes and denial of service, with potential for limited code execution in targeted attacks.
If Mitigated
Application crash with no data loss if proper sandboxing and privilege separation are implemented.
🎯 Exploit Status
Exploitation requires user interaction to open malicious PRT files; no authentication needed for file parsing.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Autodesk advisory ADSK-SA-2025-0015 for specific patched versions
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0015
Restart Required: Yes
Instructions:
1. Visit the Autodesk security advisory. 2. Identify affected products and versions. 3. Download and install the latest updates from Autodesk. 4. Restart affected applications and systems.
🔧 Temporary Workarounds
Block PRT file extensions
allPrevent processing of PRT files at network or endpoint level
User education on file handling
allTrain users to avoid opening PRT files from untrusted sources
🧯 If You Can't Patch
- Implement application whitelisting to restrict execution of vulnerable Autodesk binaries
- Deploy endpoint detection and response (EDR) solutions to monitor for suspicious file parsing activity
🔍 How to Verify
Check if Vulnerable:
Check installed Autodesk product versions against the vendor advisory; if using affected versions and processing PRT files, assume vulnerable.Check Version:
Check within Autodesk application: Help → About or use system-specific package management commands.Verify Fix Applied:
Verify installed Autodesk product versions match or exceed patched versions listed in the advisory.📡 Detection & Monitoring
Log Indicators:
- Application crashes related to PRT file parsing
- Unexpected process termination of Autodesk applications
Network Indicators:
- Inbound PRT file transfers to endpoints with Autodesk software
SIEM Query:
EventID: 1000 (Application Error) with Autodesk process names OR File creation events with .prt extension