CVE-2025-5039

Estado: ModificadaAlta (7.8)—

A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context of the current process due to an untrusted search path being utilized.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Puntuación base: 7.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.18%
Percentil entre todas las CVEs puntuadas: 6
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1203 Exploitation for Client Executionexecution85 %
Impacto principalT1574.007 Path Interception by PATH Environment Variablestealth · execution80 %
Impacto secundarioT1059 Command and Scripting Interpreterexecution75 %

Fichero binario malicioso (entrega local, UI:R) en ruta de búsqueda no confiable → ejecución en contexto del proceso actual. AV:L + UI:R → T1203 (ejecución en cliente). Impacto: carga de DLL desde ruta no confiable (T1574.007) y ejecución de código arbitrario (T1059).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution Prevention Audit Restrict Web-Based Content Restrict File and Directory Permissions Privileged Account Management Limit Software Installation

Tecnologías afectadas (6)

Autodesk — Infrastructure Parts Editor Autodesk — Inventor Autodesk — Navisworks Manage Autodesk — Navisworks Simulate Autodesk — Revit Autodesk — Vault

CWE

CWE-426

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-5039",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-5039",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-25T03:55:31.845753Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@autodesk.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@autodesk.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:*"
          ],
          "vendor": "Autodesk",
          "product": "AutoCAD",
          "versions": [
            {
              "status": "affected",
              "version": "2026",
              "lessThan": "2026.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:*"
          ],
          "vendor": "Autodesk",
          "product": "AutoCAD LT",
          "versions": [
            {
              "status": "affected",
              "version": "2026",
              "lessThan": "2026.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:autodesk:realdwg:2026:*:*:*:*:*:*:*"
          ],
          "vendor": "Autodesk",
          "product": "RealDWG",
          "versions": [
            {
              "status": "affected",
              "version": "2026",
              "lessThan": "2026.0.2",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:autodesk:3ds_max:2027:*:*:*:*:*:*:*",
            "cpe:2.3:a:autodesk:3ds_max:2026:*:*:*:*:*:*:*"
          ],
          "vendor": "Autodesk",
          "product": "3ds Max",
          "versions": [
            {
              "status": "affected",
              "version": "2027",
              "lessThan": "2027.1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2026",
              "lessThan": "2026.3.3",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-24T17:15:32.817",
  "references": [
    {
      "url": "https://www.autodesk.com/products/autodesk-access/overview",
      "source": "psirt@autodesk.com"
    },
    {
      "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0014",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@autodesk.com"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@autodesk.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-426"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context of the current process due to an untrusted search path being utilized."
    },
    {
      "lang": "es",
      "value": "Un archivo binario manipulado con fines malintencionados, cuando está presente durante la carga de archivos en ciertas aplicaciones de Autodesk, podría provocar la ejecución de código arbitrario en el contexto del proceso actual debido al uso de una ruta de búsqueda no confiable."
    }
  ],
  "lastModified": "2026-06-17T09:47:04.703",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:autodesk:infrastructure_parts_editor:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03EE8BC1-4EC3-49E3-9C1C-CFBD8C531ECD",
              "versionEndExcluding": "2026.0.2",
              "versionStartIncluding": "2026"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:inventor:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF7D5DEC-D172-49F2-89AE-9BFC5DFE98A6",
              "versionEndExcluding": "2026.0.2",
              "versionStartIncluding": "2026"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:navisworks_manage:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E916918-4CF5-4628-BD1B-C6FA94CBB353",
              "versionEndExcluding": "2026.0.2",
              "versionStartIncluding": "2026"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:navisworks_simulate:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5AB26D6-C349-48FB-9A09-C32C987904A8",
              "versionEndExcluding": "2026.0.2",
              "versionStartIncluding": "2026"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0B92B643-9C29-4604-8967-EB7A238120AB",
              "versionEndExcluding": "2026.0.2",
              "versionStartIncluding": "2026"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:vault:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AAA7B4A5-345D-47E2-B295-0AF2BE88C19E",
              "versionEndExcluding": "2026.0.2",
              "versionStartIncluding": "2026"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@autodesk.com"
}