What’s Vulnerable › Vulnerabilities

CVE-2025-5039: Privilege Ecalation due to Untrusted Search Path Vulnerability

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-24 · updated 2026-06-17
• Weakness: CWE-426

Description

A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context of the current process due to an untrusted search path being utilized.

Affected products

• Autodesk Infrastructure Parts Editor: from 2026 before 2026.0.2 — fixed in 2026.0.2
• Autodesk Inventor: from 2026 before 2026.0.2 — fixed in 2026.0.2
• Autodesk Navisworks Manage: from 2026 before 2026.0.2 — fixed in 2026.0.2
• Autodesk Navisworks Simulate: from 2026 before 2026.0.2 — fixed in 2026.0.2
• Autodesk Revit: from 2026 before 2026.0.2 — fixed in 2026.0.2
• Autodesk Vault: from 2026 before 2026.0.2 — fixed in 2026.0.2

How to fix

Upgrade to a fixed version: Autodesk Infrastructure Parts Editor 2026.0.2; Autodesk Inventor 2026.0.2; Autodesk Navisworks Manage 2026.0.2; Autodesk Navisworks Simulate 2026.0.2; Autodesk Revit 2026.0.2; Autodesk Vault 2026.0.2. Check the vendor advisory for mitigations.

References

• https://www.autodesk.com/products/autodesk-access/overview
• https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0014

Get alerted when CVE-2025-5039 or the next vulnerability affects your stack