汇总 Autodesk 相关全部产品的 CVE 与安全漏洞情报，包括 CVSS、EPSS、公开时间与漏洞情报数据。
已披露问题常与 缓冲区溢出、跨站脚本与路径处理缺陷 相关，可能在 生产负载与软件部署 场景中带来 应用崩溃与会话劫持 等暴露风险。
相关漏洞数据主要来源于公开漏洞披露与安全公告，可用于评估历史漏洞暴露面与修复优先级。
| CVE | 摘要 | 来源 | 最高 CVSS | EPSS % | 公开时间 | 更新时间 |
|---|---|---|---|---|---|---|
| CVE-2026-10789 | A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user. | [email protected] | 9.6 | 0.38% | 2026-06-22 | 2026-06-24 |
| CVE-2026-1288 | A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition. | [email protected] | 5.5 | 0.11% | 2026-06-17 | 2026-06-29 |
| CVE-2026-7454 | A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | [email protected] | 7.8 | 0.13% | 2026-05-26 | 2026-06-17 |
| CVE-2026-7453 | A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can cause a Stack Exhaustion vulnerability, leading to a denial-of-service condition. | [email protected] | 5.5 | 0.15% | 2026-05-26 | 2026-06-17 |
| CVE-2026-7452 | A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | [email protected] | 7.8 | 0.17% | 2026-05-26 | 2026-06-17 |
| CVE-2026-7451 | A maliciously crafted TIF file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | [email protected] | 7.8 | 0.17% | 2026-05-26 | 2026-06-17 |
| CVE-2026-7450 | A maliciously crafted PAR file, when parsed through Autodesk 3ds Max, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition. | [email protected] | 5.5 | 0.15% | 2026-05-26 | 2026-06-17 |
| CVE-2026-4369 | A maliciously crafted HTML payload in an assembly variant name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process. | [email protected] | 7.1 | 0.20% | 2026-04-14 | 2026-06-17 |
| CVE-2026-4345 | A maliciously crafted HTML payload, stored in a design name and exported to CSV, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process. | [email protected] | 7.1 | 0.20% | 2026-04-14 | 2026-06-17 |
| CVE-2026-4344 | A maliciously crafted HTML payload in a component name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process. | [email protected] | 7.1 | 0.20% | 2026-04-14 | 2026-06-17 |
| CVE-2026-0875 | A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | [email protected] | 7.8 | 0.21% | 2026-02-18 | 2026-06-17 |
| CVE-2026-0874 | A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | [email protected] | 7.8 | 0.21% | 2026-02-18 | 2026-06-17 |
| CVE-2026-0536 | A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can cause a Stack-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | [email protected] | 7.8 | 0.18% | 2026-02-04 | 2026-06-17 |
| CVE-2026-0662 | A maliciously crafted project directory, when opening a max file in Autodesk 3ds Max, could lead to execution of arbitrary code in the context of the current process due to an Untrusted Search Path being utilized. | [email protected] | 7.8 | 0.18% | 2026-02-04 | 2026-06-17 |
| CVE-2026-0661 | A maliciously crafted RGB file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | [email protected] | 8.4 | 0.18% | 2026-02-04 | 2026-06-17 |
| CVE-2026-0660 | A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can cause a Stack-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | [email protected] | 8.4 | 0.19% | 2026-02-04 | 2026-06-17 |
| CVE-2026-0538 | A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | [email protected] | 8.4 | 0.18% | 2026-02-04 | 2026-06-17 |
| CVE-2026-0537 | A maliciously crafted RGB file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | [email protected] | 8.4 | 0.17% | 2026-02-04 | 2026-06-17 |
| CVE-2026-0535 | A maliciously crafted HTML payload, stored in a component’s description and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process. | [email protected] | 8.1 | 0.58% | 2026-01-22 | 2026-06-17 |
| CVE-2026-0534 | A maliciously crafted HTML payload, stored in a part’s attribute and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process. | [email protected] | 8.1 | 0.47% | 2026-01-22 | 2026-06-17 |