{"id":"CVE-2026-7405","title":"A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library","summary":"A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cwe":["CWE-125"],"vendor":"autodesk","product":"advance_steel","affected":["advance_steel >= 2027, < 2027.1","autocad >= 2027, < 2027.1","autocad_architecture >= 2027, < 2027.1","autocad_electrical >= 2027, < 2027.1","autocad_lt >= 2027, < 2027.1","autocad_map_3d >= 2027, < 2027.1","autocad_mechanical >= 2027, < 2027.1","autocad_mep >= 2027, < 2027.1","autocad_plant_3d >= 2027, < 2027.1","civil_3d >= 2027, < 2027.1","dwg_trueview >= 2027, < 2027.1","revit >= 2025, < 2025.3.5","revit >= 2026, < 2026.5","revit >= 2027, < 2027.1"],"patched":["advance_steel 2027.1","autocad 2027.1","autocad_architecture 2027.1","autocad_electrical 2027.1","autocad_lt 2027.1","autocad_map_3d 2027.1","autocad_mechanical 2027.1","autocad_mep 2027.1","autocad_plant_3d 2027.1","civil_3d 2027.1","dwg_trueview 2027.1","revit 2027.1"],"published":"2026-08-06","updated":"2026-09-18","sourceUpdated":"2026-09-18T15:17:13.543","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7405","references":[{"url":"https://www.autodesk.com/products/autodesk-access/overview","label":"psirt@autodesk.com"},{"url":"https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0012","label":"psirt@autodesk.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-08-07T17:22:24.248444Z"},"epss":0.00115,"epssPercentile":0.01789,"ingestedAt":"2026-09-18T14:43:13.067Z","slug":"CVE-2026-7405","body":"## Overview\n\nA maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service\n\n## Affected\n\n- `advance_steel >= 2027, < 2027.1`\n- `autocad >= 2027, < 2027.1`\n- `autocad_architecture >= 2027, < 2027.1`\n- `autocad_electrical >= 2027, < 2027.1`\n- `autocad_lt >= 2027, < 2027.1`\n- `autocad_map_3d >= 2027, < 2027.1`\n- `autocad_mechanical >= 2027, < 2027.1`\n- `autocad_mep >= 2027, < 2027.1`\n- `autocad_plant_3d >= 2027, < 2027.1`\n- `civil_3d >= 2027, < 2027.1`\n- `dwg_trueview >= 2027, < 2027.1`\n- `revit >= 2025, < 2025.3.5`\n- `revit >= 2026, < 2026.5`\n- `revit >= 2027, < 2027.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `advance_steel 2027.1`\n- `autocad 2027.1`\n- `autocad_architecture 2027.1`\n- `autocad_electrical 2027.1`\n- `autocad_lt 2027.1`\n- `autocad_map_3d 2027.1`\n- `autocad_mechanical 2027.1`\n- `autocad_mep 2027.1`\n- `autocad_plant_3d 2027.1`\n- `civil_3d 2027.1`\n- `dwg_trueview 2027.1`\n- `revit 2027.1`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}