CVE-2025-9455
📋 TL;DR
This vulnerability allows attackers to exploit an out-of-bounds read in Autodesk products when processing malicious CATPRODUCT files. Successful exploitation could lead to crashes, sensitive data exposure, or arbitrary code execution. Users of affected Autodesk software are at risk.
💻 Affected Systems
- Autodesk Access
- Other Autodesk products that parse CATPRODUCT files
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the same privileges as the current user, potentially leading to full system compromise.
Likely Case
Application crash or denial of service, with potential for sensitive information disclosure.
If Mitigated
Limited impact with proper file validation and user privilege restrictions in place.
🎯 Exploit Status
Exploitation requires user interaction to open malicious files. No public exploit code is mentioned in the provided references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory ADSK-SA-2025-0024 for specific patched versions
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0024
Restart Required: Yes
Instructions:
1. Review Autodesk advisory ADSK-SA-2025-0024. 2. Identify affected products and versions. 3. Update to the latest patched version through Autodesk Access or official download channels. 4. Restart the application after installation.
🔧 Temporary Workarounds
Restrict CATPRODUCT file handling
allBlock or restrict processing of untrusted CATPRODUCT files through application settings or group policies.
User awareness training
allEducate users to avoid opening CATPRODUCT files from untrusted sources.
🧯 If You Can't Patch
- Implement application whitelisting to restrict execution of vulnerable Autodesk software versions.
- Use network segmentation to isolate systems running vulnerable software from critical assets.
🔍 How to Verify
Check if Vulnerable:
Check installed Autodesk product versions against the patched versions listed in advisory ADSK-SA-2025-0024.Check Version:
Within Autodesk application: Help > About or check via Autodesk Access management console.Verify Fix Applied:
Confirm that Autodesk products are updated to versions specified in the vendor advisory as patched.📡 Detection & Monitoring
Log Indicators:
- Application crash logs related to CATPRODUCT file parsing
- Unexpected out-of-bounds read errors in application logs
Network Indicators:
- Unusual file transfers of CATPRODUCT files from external sources
SIEM Query:
Example: source="autodesk_logs" AND (event="crash" OR error="out_of_bounds") AND file_extension="CATPRODUCT"