CVE-2026-7405 - TIF File Parsing Out-of-Bounds Read in certain Autodesk products

Back Back to CVE browser

MEDIUM

TIF File Parsing Out-of-Bounds Read in certain Autodesk products

Published Aug 6, 2026

5.5

MEDIUM

CVSS 3.1

EPSS 0.16%

Description

A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service

Affected products

Vendor Autodesk Product AutoCAD Default
unaffected
Affected
- ≥ 2026.0.0, < 2026.1.2
- ≥ 2027.0.0, < 2027.1.0
Vendor Autodesk Product AutoCAD LT Default
unaffected
Affected
- ≥ 2026.0.0, < 2026.1.2
- ≥ 2027.0.0, < 2027.1.0
Vendor Autodesk Product DWG TrueView Default
unaffected
Affected
- ≥ 2026.0.0, < 2026.1.2
- ≥ 2027.0.0, < 2027.1.0
Vendor Autodesk Product Revit Default
unaffected
Affected
- ≥ 2024.0.0, < 2024.3.5
- ≥ 2025.0.0, < 2025.5.0
- ≥ 2026.0.0, < 2026.5.0
- ≥ 2027.0.0, < 2027.1.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Autodesk	AutoCAD	unaffected	Affected ≥ 2026.0.0, < 2026.1.2 ≥ 2027.0.0, < 2027.1.0
Autodesk	AutoCAD LT	unaffected	Affected ≥ 2026.0.0, < 2026.1.2 ≥ 2027.0.0, < 2027.1.0
Autodesk	DWG TrueView	unaffected	Affected ≥ 2026.0.0, < 2026.1.2 ≥ 2027.0.0, < 2027.1.0
Autodesk	Revit	unaffected	Affected ≥ 2024.0.0, < 2024.3.5 ≥ 2025.0.0, < 2025.5.0 ≥ 2026.0.0, < 2026.5.0 ≥ 2027.0.0, < 2027.1.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-54292
Advisory
https://www.autodesk.com/products/autodesk-access/overview
patchProduct
https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0012
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-54292		Advisory
https://www.autodesk.com/products/autodesk-access/overview		patchProduct
https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0012		vendor-advisoryVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner autodesk

Published Aug 6, 2026

Updated Sep 18, 2026

Reserved Apr 29, 2026

Link CVE-2026-7405

CISA Vulnrichment

Updated Aug 7, 2026

NVD

Status Analyzed

Modified Sep 18, 2026

Link CVE-2026-7405

Red Hat

No data

ENISA EUVD

Assigner autodesk

Published Aug 6, 2026

Updated Sep 18, 2026

Link EUVD-2026-54292

GitHub

No data