What’s Vulnerable › Vulnerabilities
CVE-2024-11454: Untrusted Search Path vulnerability in Autodesk Revit
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-12-09 · updated 2026-06-17
- Weakness: CWE-426
Description
A maliciously crafted DLL file, when placed in the same directory as an RVT file could be loaded by Autodesk Revit, and execute arbitrary code in the context of the current process due to an untrusted search patch being utilized.
Affected products
- Autodesk Revit: from 2025 before 2025.4 — fixed in 2025.4
How to fix
Upgrade to a fixed version: Autodesk Revit 2025.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-11454 or the next vulnerability affects your stack