CVE-2026-16463

Estado: AnalizadaAlta (7.8)—

A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Puntuación base: 7.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.28%
Percentil entre todas las CVEs puntuadas: 19
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1203 Exploitation for Client Executionexecution95 %
Impacto principalT1059 Command and Scripting Interpreterexecution85 %
Impacto secundarioT1005 Data from Local Systemcollection80 %
Impacto secundarioT1499.004 Application or System Exploitationimpact75 %

Vector CVSS con AV:L/UI:R indica ejecución en cliente; archivo DXF preparado requiere interacción del usuario. Heap overflow permite ejecución de código arbitrario (T1059), lectura de datos sensibles (T1005) o denegación de servicio (T1499.004).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict Web-Based Content Privileged Account Management Limit Software Installation Filter Network Traffic Execution Prevention Behavior Prevention on Endpoint

Tecnologías afectadas (11)

Autodesk — Advance Steel Autodesk — Autocad Autodesk — Autocad Architecture Autodesk — Autocad Electrical Autodesk — Autocad LT Autodesk — Autocad MAP 3D Autodesk — Autocad Mechanical Autodesk — Autocad MEP Autodesk — Autocad Plant 3D Autodesk — Civil 3D Autodesk — DWG Trueview

CWE

CWE-122

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-16463",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-16463",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-29T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@autodesk.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@autodesk.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:*"
          ],
          "vendor": "Autodesk",
          "product": "AutoCAD",
          "versions": [
            {
              "status": "affected",
              "version": "2027.0.0",
              "lessThan": "2027.1.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:*"
          ],
          "vendor": "Autodesk",
          "product": "AutoCAD LT",
          "versions": [
            {
              "status": "affected",
              "version": "2027.0.0",
              "lessThan": "2027.1.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:*"
          ],
          "vendor": "Autodesk",
          "product": "DWG TrueView",
          "versions": [
            {
              "status": "affected",
              "version": "2027.0.0",
              "lessThan": "2027.1.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-07-29T16:17:50.377",
  "references": [
    {
      "url": "https://www.autodesk.com/products/autodesk-access/overview",
      "tags": [
        "Product"
      ],
      "source": "psirt@autodesk.com"
    },
    {
      "url": "https://www.autodesk.com/products/dwg-trueview/overview",
      "tags": [
        "Product"
      ],
      "source": "psirt@autodesk.com"
    },
    {
      "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0009",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@autodesk.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@autodesk.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."
    }
  ],
  "lastModified": "2026-09-02T18:19:14.803",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:autodesk:advance_steel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "303177A6-3AC8-4048-9260-BE6E86D71437",
              "versionEndExcluding": "2026.1.2",
              "versionStartIncluding": "2026"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:advance_steel:2027:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9BED60D2-DC91-4AF9-B85D-EE5D0AD9AEAD"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A845C578-5C59-4988-BB5F-BD4FFF655C0C",
              "versionEndExcluding": "2026.1.2",
              "versionStartIncluding": "2026"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3298FE02-0B09-4D79-8D3B-0614CCEDD8C0"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A20FFE6-0F7A-4734-8071-0D351F5C37A0",
              "versionEndExcluding": "2026.1.2",
              "versionStartIncluding": "2026"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:autocad_architecture:2027:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AEFC7FB9-183A-4AC2-84A0-C727696A989A"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94F7C12F-3668-4AD3-8B82-FC3FEE28B10C",
              "versionEndExcluding": "2026.1.2",
              "versionStartIncluding": "2026"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:autocad_electrical:2027:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FCB3F3D2-D351-4D86-92C4-4F5E387964EE"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0628F060-8C96-4320-9F8E-9053D13B2FAE",
              "versionEndExcluding": "2026.1.2",
              "versionStartIncluding": "2026"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:-:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C2AE48B-3CCD-4257-AB83-1131A45A7DC1"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5A4481A-91BD-4B7E-9B2E-C0ADAFDFB068",
              "versionEndExcluding": "2026.1.2",
              "versionStartIncluding": "2026"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:autocad_map_3d:2027:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5E0024A-59B9-43A9-AED4-B45085C17AA2"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94246F19-8A61-4598-BDF8-02B014AD042B",
              "versionEndExcluding": "2026.1.2",
              "versionStartIncluding": "2026"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:autocad_mechanical:2027:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DEA6EFC7-862F-4140-B34D-7D10A030BD1E"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "87DF4DA7-34D3-4262-BEDF-5F0D4326613F",
              "versionEndExcluding": "2026.1.2",
              "versionStartIncluding": "2026"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:autocad_mep:2027:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F76E40DC-5CE6-4504-BC24-2B716DFFC20F"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4597F18D-C09D-4298-8B34-6F612C4DB65B",
              "versionEndExcluding": "2026.1.2",
              "versionStartIncluding": "2026"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:autocad_plant_3d:2027:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "672FFCF8-8CD7-404C-8C1D-3015D03956C6"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:civil_3d:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7EF4B6E9-F686-46B9-8E92-4E08C492665E",
              "versionEndExcluding": "2026.1.2",
              "versionStartIncluding": "2026"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:civil_3d:2027:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7707F083-4B63-4ADB-BB68-99189D7EC682"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:dwg_trueview:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF4E5FD5-7993-4D44-B640-AB8D37F4EE0B",
              "versionEndExcluding": "2026.1.2",
              "versionStartIncluding": "2026"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40A1D383-5984-4D80-B705-8A3340F653B0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@autodesk.com"
}