CVE-2026-7406

A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

Scoring

Severity

HIGH

CVSS base score

7.8

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS probability

0.13%

CWE

CWE-822

Published

2026-08-06

Last modified

2026-09-02

Affected products

• Autodesk Revit
• Autodesk Revit
• Autodesk Revit
• Autodesk AutoCAD
• Autodesk AutoCAD LT
• Autodesk AutoCAD
• Autodesk AutoCAD LT
• Autodesk DWG TrueView

Weakness type

• CWE-822

Related vulnerabilities

• CVE-2026-83498 — Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
• CVE-2026-83939 — Windows Secure Kernel Mode Elevation of Privilege Vulnerability
• CVE-2026-78451 — Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability
• CVE-2026-78444 — Microsoft Failover Cluster Remote Code Execution Vulnerability
• CVE-2026-72938 — Microsoft Office PowerPoint Information Disclosure Vulnerability
• CVE-2026-72956 — Microsoft Office PowerPoint Information Disclosure Vulnerability
• CVE-2026-69874 — Windows ALPC Elevation of Privilege Vulnerability
• CVE-2026-69900 — Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability

Markdown version · Browse all CVEs