CVE-2025-5040

Published Jul 10, 2025

Last updated 7 months ago

CVSS high 7.8

Overview

Description: A maliciously crafted RTE file, when parsed through Autodesk Revit, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Source: psirt@autodesk.com
NVD status: Analyzed
Products: revit

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

psirt@autodesk.com: CWE-122

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "F441B410-A562-4443-B71D-3B90D0CB9822",
            "versionEndExcluding": "2024.3.3",
            "versionStartIncluding": "2024",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E1784137-30D2-4B15-B90F-D04D776E7F12",
            "versionEndExcluding": "2025.4.2",
            "versionStartIncluding": "2025",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "0C81B830-67E4-452F-B0B1-70986E880968",
            "versionEndExcluding": "2026.2",
            "versionStartIncluding": "2026",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References