CVE-2025-8354

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8354", "assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601", "state": "PUBLISHED", "assignerShortName": "autodesk", "dateReserved": "2025-07-30T13:45:53.877Z", "datePublished": "2025-09-23T13:20:03.452Z", "dateUpdated": "2026-02-26T17:48:17.430Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit:2025:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit:2024:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Revit", "vendor": "Autodesk", "versions": [{"lessThan": "2026.3", "status": "affected", "version": "2026", "versionType": "custom"}, {"lessThan": "2025.4.4", "status": "affected", "version": "2025", "versionType": "custom"}, {"lessThan": "2024.3.4", "status": "affected", "version": "2024", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:autodesk:revit_lt:2026:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit_lt:2025:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit_lt:2024:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Revit LT", "vendor": "Autodesk", "versions": [{"lessThan": "2026.3", "status": "affected", "version": "2026", "versionType": "custom"}, {"lessThan": "2025.4.4", "status": "affected", "version": "2025", "versionType": "custom"}, {"lessThan": "2024.3.4", "status": "affected", "version": "2024", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A maliciously crafted RFA file, when parsed through Autodesk Revit, can force a Type Confusion vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.<br>"}], "value": "A maliciously crafted RFA file, when parsed through Autodesk Revit, can force a Type Confusion vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."}], "impacts": [{"capecId": "CAPEC-255", "descriptions": [{"lang": "en", "value": "CAPEC-255 Manipulate Data Structures"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-843", "description": "CWE-843 Type Confusion", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601", "shortName": "autodesk", "dateUpdated": "2025-12-02T15:20:37.992Z"}, "references": [{"tags": ["patch"], "url": "https://www.autodesk.com/products/autodesk-access/overview"}, {"tags": ["vendor-advisory"], "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0021"}], "source": {"discovery": "EXTERNAL"}, "title": "RFA File Parsing Type Confusion Vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8354", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-24T03:55:16.087083Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T17:48:17.430Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8354", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-23T14:00:19.068856Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-23T14:00:20.895Z"}}], "cna": {"title": "RFA File Parsing Type Confusion Vulnerability", "source": {"discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-255", "descriptions": [{"lang": "en", "value": "CAPEC-255 Manipulate Data Structures"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit:2025:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit:2024:*:*:*:*:*:*:*"], "vendor": "Autodesk", "product": "Revit", "versions": [{"status": "affected", "version": "2026", "lessThan": "2026.3", "versionType": "custom"}, {"status": "affected", "version": "2025", "lessThan": "2025.4.4", "versionType": "custom"}, {"status": "affected", "version": "2024", "lessThan": "2024.3.4", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:autodesk:revit_lt:2026:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit_lt:2025:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit_lt:2024:*:*:*:*:*:*:*"], "vendor": "Autodesk", "product": "Revit LT", "versions": [{"status": "affected", "version": "2026", "lessThan": "2026.3", "versionType": "custom"}, {"status": "affected", "version": "2025", "lessThan": "2025.4.4", "versionType": "custom"}, {"status": "affected", "version": "2024", "lessThan": "2024.3.4", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.autodesk.com/products/autodesk-access/overview", "tags": ["patch"]}, {"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0021", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A maliciously crafted RFA file, when parsed through Autodesk Revit, can force a Type Confusion vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.", "supportingMedia": [{"type": "text/html", "value": "A maliciously crafted RFA file, when parsed through Autodesk Revit, can force a Type Confusion vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-843", "description": "CWE-843 Type Confusion"}]}], "providerMetadata": {"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601", "shortName": "autodesk", "dateUpdated": "2025-12-02T15:20:37.992Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8354", "state": "PUBLISHED", "dateUpdated": "2025-12-02T15:20:37.992Z", "dateReserved": "2025-07-30T13:45:53.877Z", "assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601", "datePublished": "2025-09-23T13:20:03.452Z", "assignerShortName": "autodesk"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit:2025:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit:2024:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Revit", "vendor": "Autodesk", "versions": [{"lessThan": "2026.3", "status": "affected", "version": "2026", "versionType": "custom"}, {"lessThan": "2025.4.4", "status": "affected", "version": "2025", "versionType": "custom"}, {"lessThan": "2024.3.4", "status": "affected", "version": "2024", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:autodesk:revit_lt:2026:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit_lt:2025:*:*:*:*:*:*:*", "cpe:2.3:a:autodesk:revit_lt:2024:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Revit LT", "vendor": "Autodesk", "versions": [{"lessThan": "2026.3", "status": "affected", "version": "2026", "versionType": "custom"}, {"lessThan": "2025.4.4", "status": "affected", "version": "2025", "versionType": "custom"}, {"lessThan": "2024.3.4", "status": "affected", "version": "2024", "versionType": "custom"}]}], "source": "psirt@autodesk.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:*", "matchCriteriaId": "F1EA8A6E-9199-42C0-A807-952406DA952C", "versionEndExcluding": "2026.3", "versionStartIncluding": "2026", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A maliciously crafted RFA file, when parsed through Autodesk Revit, can force a Type Confusion vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."}, {"lang": "es", "value": "Un archivo RFA creado maliciosamente, cuando es analizado por Autodesk Revit, puede forzar una vulnerabilidad de confusi\u00f3n de tipos. Un actor malicioso puede aprovechar esta vulnerabilidad para causar un fallo, causar corrupci\u00f3n de datos o ejecutar c\u00f3digo arbitrario en el contexto del proceso actual."}], "id": "CVE-2025-8354", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "psirt@autodesk.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8354", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-24T03:55:16.087083Z", "version": "2.0.3"}}]}, "published": "2025-09-23T14:15:41.597", "references": [{"source": "psirt@autodesk.com", "tags": ["Product"], "url": "https://www.autodesk.com/products/autodesk-access/overview"}, {"source": "psirt@autodesk.com", "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0021"}], "sourceIdentifier": "psirt@autodesk.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-843"}], "source": "psirt@autodesk.com", "type": "Secondary"}]}

{}

{}