CVE-2025-5042

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5042", "assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601", "state": "PUBLISHED", "assignerShortName": "autodesk", "dateReserved": "2025-05-21T13:01:02.071Z", "datePublished": "2025-07-22T16:02:51.214Z", "dateUpdated": "2026-02-26T17:50:25.096Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit:2025:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit:2024:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit:2023:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Revit", "vendor": "Autodesk", "versions": [{"lessThan": "2026.2", "status": "affected", "version": "2026", "versionType": "custom"}, {"lessThan": "2025.4.3", "status": "affected", "version": "2025", "versionType": "custom"}, {"lessThan": "2024.3.4", "status": "affected", "version": "2024", "versionType": "custom"}, {"lessThan": "2023.1.8", "status": "affected", "version": "2023", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:autodesk:revit_lt:2026:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit_lt:2025:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit_lt:2024:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit_lt:2023:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Revit LT", "vendor": "Autodesk", "versions": [{"lessThan": "2026.2", "status": "affected", "version": "2026", "versionType": "custom"}, {"lessThan": "2025.4.3", "status": "affected", "version": "2025", "versionType": "custom"}, {"lessThan": "2024.3.4", "status": "affected", "version": "2024", "versionType": "custom"}, {"lessThan": "2023.1.8", "status": "affected", "version": "2023", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A maliciously crafted RFA file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.<br>"}], "value": "A maliciously crafted RFA file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "CWE-125 Out-of-Bounds Read", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601", "shortName": "autodesk", "dateUpdated": "2025-10-06T15:21:12.952Z"}, "references": [{"tags": ["patch"], "url": "https://www.autodesk.com/products/autodesk-access/overview"}, {"tags": ["vendor-advisory"], "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0013"}], "source": {"discovery": "EXTERNAL"}, "title": "RFA File Parsing Out-of-Bounds Read Vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5042", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-24T03:55:23.416407Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T17:50:25.096Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5042", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-24T03:55:23.416407Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-22T18:50:36.349Z"}}], "cna": {"title": "RFA File Parsing Out-of-Bounds Read Vulnerability", "source": {"discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit:2025:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit:2024:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit:2023:*:*:*:*:*:*:*"], "vendor": "Autodesk", "product": "Revit", "versions": [{"status": "affected", "version": "2026", "lessThan": "2026.2", "versionType": "custom"}, {"status": "affected", "version": "2025", "lessThan": "2025.4.3", "versionType": "custom"}, {"status": "affected", "version": "2024", "lessThan": "2024.3.4", "versionType": "custom"}, {"status": "affected", "version": "2023", "lessThan": "2023.1.8", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:autodesk:revit_lt:2026:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit_lt:2025:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit_lt:2024:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit_lt:2023:*:*:*:*:*:*:*"], "vendor": "Autodesk", "product": "Revit LT", "versions": [{"status": "affected", "version": "2026", "lessThan": "2026.2", "versionType": "custom"}, {"status": "affected", "version": "2025", "lessThan": "2025.4.3", "versionType": "custom"}, {"status": "affected", "version": "2024", "lessThan": "2024.3.4", "versionType": "custom"}, {"status": "affected", "version": "2023", "lessThan": "2023.1.8", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.autodesk.com/products/autodesk-access/overview", "tags": ["patch"]}, {"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0013", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A maliciously crafted RFA file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.", "supportingMedia": [{"type": "text/html", "value": "A maliciously crafted RFA file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-Bounds Read"}]}], "providerMetadata": {"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601", "shortName": "autodesk", "dateUpdated": "2025-10-06T15:21:12.952Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5042", "state": "PUBLISHED", "dateUpdated": "2026-02-26T17:50:25.096Z", "dateReserved": "2025-05-21T13:01:02.071Z", "assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601", "datePublished": "2025-07-22T16:02:51.214Z", "assignerShortName": "autodesk"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit:2025:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit:2024:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit:2023:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Revit", "vendor": "Autodesk", "versions": [{"lessThan": "2026.2", "status": "affected", "version": "2026", "versionType": "custom"}, {"lessThan": "2025.4.3", "status": "affected", "version": "2025", "versionType": "custom"}, {"lessThan": "2024.3.4", "status": "affected", "version": "2024", "versionType": "custom"}, {"lessThan": "2023.1.8", "status": "affected", "version": "2023", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:autodesk:revit_lt:2026:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit_lt:2025:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit_lt:2024:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit_lt:2023:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Revit LT", "vendor": "Autodesk", "versions": [{"lessThan": "2026.2", "status": "affected", "version": "2026", "versionType": "custom"}, {"lessThan": "2025.4.3", "status": "affected", "version": "2025", "versionType": "custom"}, {"lessThan": "2024.3.4", "status": "affected", "version": "2024", "versionType": "custom"}, {"lessThan": "2023.1.8", "status": "affected", "version": "2023", "versionType": "custom"}]}], "source": "psirt@autodesk.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:*", "matchCriteriaId": "0C81B830-67E4-452F-B0B1-70986E880968", "versionEndExcluding": "2026.2", "versionStartIncluding": "2026", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A maliciously crafted RFA file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."}, {"lang": "es", "value": "Un archivo RFA manipulado con fines maliciosos, al analizarse mediante Autodesk Revit, puede forzar una vulnerabilidad de lectura fuera de los l\u00edmites. Un agente malicioso puede aprovechar esta vulnerabilidad para provocar un bloqueo, leer datos confidenciales o ejecutar c\u00f3digo arbitrario en el contexto del proceso actual."}], "id": "CVE-2025-5042", "lastModified": "2026-06-17T09:47:04.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "psirt@autodesk.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5042", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-07-24T03:55:23.416407Z", "version": "2.0.3"}}]}, "published": "2025-07-22T16:15:34.307", "references": [{"source": "psirt@autodesk.com", "url": "https://www.autodesk.com/products/autodesk-access/overview"}, {"source": "psirt@autodesk.com", "tags": ["Vendor Advisory"], "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0013"}], "sourceIdentifier": "psirt@autodesk.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "psirt@autodesk.com", "type": "Secondary"}]}

{}

{"created": "2025-07-23T20:19:26.497190+00:00", "updated": "2025-07-23T20:19:26.497263+00:00", "vendors": ["autodesk", "autodesk$PRODUCT$revit"]}