CVE-2025-9454
📋 TL;DR
CVE-2025-9454 is an out-of-bounds read vulnerability in Autodesk products that parse PRT files. Attackers can exploit this to crash applications, read sensitive memory, or potentially execute arbitrary code. Users of affected Autodesk software are at risk when opening malicious PRT files.
💻 Affected Systems
- Autodesk Access
- Other Autodesk products that parse PRT files
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data theft, or ransomware deployment.
Likely Case
Application crashes and potential information disclosure through memory reads.
If Mitigated
Limited impact with proper file validation and least privilege controls.
🎯 Exploit Status
Exploitation requires user interaction to open malicious file; memory corruption may be challenging to weaponize for RCE.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched versions
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0024
Restart Required: Yes
Instructions:
1. Review Autodesk advisory ADSK-SA-2025-0024. 2. Update affected Autodesk products to latest patched versions. 3. Restart systems after patching.
🔧 Temporary Workarounds
Block PRT file extensions
allPrevent processing of PRT files via email filters or endpoint controls.
User awareness training
allEducate users not to open PRT files from untrusted sources.
🧯 If You Can't Patch
- Restrict PRT file execution via application control policies
- Implement network segmentation to limit lateral movement potential
🔍 How to Verify
Check if Vulnerable:
Check installed Autodesk product versions against patched versions in vendor advisory.Check Version:
Varies by product; typically check 'About' in application or use vendor-specific commands.Verify Fix Applied:
Confirm product version matches or exceeds patched version listed in advisory.📡 Detection & Monitoring
Log Indicators:
- Application crashes related to PRT file parsing
- Unexpected memory access errors in application logs
Network Indicators:
- Inbound PRT files from untrusted sources
- Unusual outbound connections after PRT file processing
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName contains 'Autodesk' AND FileExtension='.prt'