CVE-2026-7405: TIF File Parsing Out-of-Bounds Read in certain Autodesk products

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-06 · updated 2026-10-24
Weakness: CWE-125

Description

A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service

Affected products

Autodesk Advance Steel: from 2027 before 2027.1 — fixed in 2027.1
Autodesk AutoCAD: from 2027 before 2027.1 — fixed in 2027.1
Autodesk AutoCAD Architecture: from 2027 before 2027.1 — fixed in 2027.1
Autodesk AutoCAD Electrical: from 2027 before 2027.1 — fixed in 2027.1
Autodesk AutoCAD LT: from 2027 before 2027.1 — fixed in 2027.1
Autodesk AutoCAD MAP 3D: from 2027 before 2027.1 — fixed in 2027.1
Autodesk AutoCAD Mechanical: from 2027 before 2027.1 — fixed in 2027.1
Autodesk AutoCAD MEP: from 2027 before 2027.1 — fixed in 2027.1
Autodesk AutoCAD Plant 3D: from 2027 before 2027.1 — fixed in 2027.1
Autodesk Civil 3D: from 2027 before 2027.1 — fixed in 2027.1
Autodesk DWG TrueView: from 2027 before 2027.1 — fixed in 2027.1
Autodesk Revit: from 2025 before 2025.3.5; from 2026 before 2026.5; from 2027 before 2027.1 — fixed in 2025.3.5, 2026.5, 2027.1

How to fix

Upgrade to a fixed version: Autodesk Advance Steel 2027.1; Autodesk AutoCAD 2027.1; Autodesk AutoCAD Architecture 2027.1; Autodesk AutoCAD Electrical 2027.1; Autodesk AutoCAD LT 2027.1; Autodesk AutoCAD MAP 3D 2027.1; Autodesk AutoCAD Mechanical 2027.1; Autodesk AutoCAD MEP 2027.1; Autodesk AutoCAD Plant 3D 2027.1; Autodesk Civil 3D 2027.1; Autodesk DWG TrueView 2027.1; Autodesk Revit 2025.3.5, 2026.5, 2027.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-7405 or the next vulnerability affects your stack