CVE-2026-16465: DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-29 · updated 2026-09-02
Weakness: CWE-125

Description

A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information.

Affected products

Autodesk Advance Steel: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2
Autodesk AutoCAD: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2
Autodesk AutoCAD Architecture: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2
Autodesk AutoCAD Electrical: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2
Autodesk AutoCAD LT: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2
Autodesk AutoCAD MAP 3D: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2
Autodesk AutoCAD Mechanical: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2
Autodesk AutoCAD MEP: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2
Autodesk AutoCAD Plant 3D: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2
Autodesk Civil 3D: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2
Autodesk DWG TrueView: from 2026 before 2026.1.2; 2027 — fixed in 2026.1.2

How to fix

Upgrade to a fixed version: Autodesk Advance Steel 2026.1.2; Autodesk AutoCAD 2026.1.2; Autodesk AutoCAD Architecture 2026.1.2; Autodesk AutoCAD Electrical 2026.1.2; Autodesk AutoCAD LT 2026.1.2; Autodesk AutoCAD MAP 3D 2026.1.2; Autodesk AutoCAD Mechanical 2026.1.2; Autodesk AutoCAD MEP 2026.1.2; Autodesk AutoCAD Plant 3D 2026.1.2; Autodesk Civil 3D 2026.1.2; Autodesk DWG TrueView 2026.1.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-16465 or the next vulnerability affects your stack