NetSight
IP …
high7.8

CVE-2025-1649

A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability.

Impact

A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

Affected products

VendorProductAffected versions
AutodeskAutocad
from 2022 before 2022.1.6
from 2023 before 2023.1.7
from 2024 before 2024.1.7
from 2025 before 2025.1.2
AutodeskAutocad Architecture
from 2022 before 2022.1.6
from 2023 before 2023.1.7
from 2024 before 2024.1.7
from 2025 before 2025.1.2
AutodeskAutocad Electrical
from 2022 before 2022.1.6
from 2023 before 2023.1.7
from 2024 before 2024.1.7
from 2025 before 2025.1.2
AutodeskAutocad Mechanical
from 2022 before 2022.1.6
from 2023 before 2023.1.7
from 2024 before 2024.1.7
from 2025 before 2025.1.2
AutodeskAutocad Mep
from 2022 before 2022.1.6
from 2023 before 2023.1.7
from 2024 before 2024.1.7
from 2025 before 2025.1.2
AutodeskAutocad Plant 3d
from 2022 before 2022.1.6
from 2023 before 2023.1.7
from 2024 before 2024.1.7
from 2025 before 2025.1.2
AutodeskCivil 3d
from 2022 before 2022.1.6
from 2023 before 2023.1.7
from 2024 before 2024.1.7
from 2025 before 2025.1.2
AutodeskAdvance Steel
from 2022 before 2022.1.6
from 2023 before 2023.1.7
from 2024 before 2024.1.7
from 2025 before 2025.1.2
AutodeskAutocad Map 3d
from 2022 before 2022.1.6
from 2023 before 2023.1.7
from 2024 before 2024.1.7
from 2025 before 2025.1.2

Weakness classification

CWE-457CWE-908

References