CVE-2026-7406: BMP File Parsing Untrusted Pointer Dereference in certain Autodesk products

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-06 · updated 2026-10-24
Weakness: CWE-822

Description

A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

Affected products

Autodesk Advance Steel: from 2027 before 2027.1 — fixed in 2027.1
Autodesk AutoCAD: from 2027 before 2027.1 — fixed in 2027.1
Autodesk AutoCAD Architecture: from 2027 before 2027.1 — fixed in 2027.1
Autodesk AutoCAD Electrical: from 2027 before 2027.1 — fixed in 2027.1
Autodesk AutoCAD LT: from 2027 before 2027.1 — fixed in 2027.1
Autodesk AutoCAD MAP 3D: from 2027 before 2027.1 — fixed in 2027.1
Autodesk AutoCAD Mechanical: from 2027 before 2027.1 — fixed in 2027.1
Autodesk AutoCAD MEP: from 2027 before 2027.1 — fixed in 2027.1
Autodesk AutoCAD Plant 3D: from 2027 before 2027.1 — fixed in 2027.1
Autodesk Civil 3D: from 2027 before 2027.1 — fixed in 2027.1
Autodesk DWG TrueView: from 2027 before 2027.1 — fixed in 2027.1
Autodesk Revit: from 2025 before 2025.3.5; from 2026 before 2026.5; from 2027 before 2027.1 — fixed in 2025.3.5, 2026.5, 2027.1

How to fix

Upgrade to a fixed version: Autodesk Advance Steel 2027.1; Autodesk AutoCAD 2027.1; Autodesk AutoCAD Architecture 2027.1; Autodesk AutoCAD Electrical 2027.1; Autodesk AutoCAD LT 2027.1; Autodesk AutoCAD MAP 3D 2027.1; Autodesk AutoCAD Mechanical 2027.1; Autodesk AutoCAD MEP 2027.1; Autodesk AutoCAD Plant 3D 2027.1; Autodesk Civil 3D 2027.1; Autodesk DWG TrueView 2027.1; Autodesk Revit 2025.3.5, 2026.5, 2027.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-7406 or the next vulnerability affects your stack