CVE-2026-16463: DXF File Parsing Heap-Based Overflow in Autodesk AutoCAD

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-29 · updated 2026-09-02
Weakness: CWE-122

Description

A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

Affected products

Autodesk Advance Steel: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2
Autodesk AutoCAD: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2
Autodesk AutoCAD Architecture: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2
Autodesk AutoCAD Electrical: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2
Autodesk AutoCAD LT: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2
Autodesk AutoCAD MAP 3D: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2
Autodesk AutoCAD Mechanical: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2
Autodesk AutoCAD MEP: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2
Autodesk AutoCAD Plant 3D: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2
Autodesk Civil 3D: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2
Autodesk DWG TrueView: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2

How to fix

Upgrade to a fixed version: Autodesk Advance Steel 2026.1.2; Autodesk AutoCAD 2026.1.2; Autodesk AutoCAD Architecture 2026.1.2; Autodesk AutoCAD Electrical 2026.1.2; Autodesk AutoCAD LT 2026.1.2; Autodesk AutoCAD MAP 3D 2026.1.2; Autodesk AutoCAD Mechanical 2026.1.2; Autodesk AutoCAD MEP 2026.1.2; Autodesk AutoCAD Plant 3D 2026.1.2; Autodesk Civil 3D 2026.1.2; Autodesk DWG TrueView 2026.1.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-16463 or the next vulnerability affects your stack