CVE-2025-1427
Published: 13 March 2025
Summary
CVE-2025-1427 is a high-severity Use of Uninitialized Variable (CWE-457) vulnerability in Autodesk Autocad. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 39.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires organizations to monitor, report, and remediate flaws like this uninitialized variable vulnerability in AutoCAD by applying vendor patches such as those in Autodesk advisory ADSK-SA-2025-0001.
Implements memory safeguards like ASLR and DEP to protect against exploitation of uninitialized variable issues leading to arbitrary code execution or sensitive data disclosure in the AutoCAD process.
Mandates validation of information inputs such as maliciously crafted CATPRODUCT files to prevent parsing errors that trigger the uninitialized variable vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a client-side memory issue in AutoCAD triggered by parsing a malicious CATPRODUCT file, directly enabling exploitation for client execution (T1203) via user opening of a malicious file (T1204.002) to achieve arbitrary code execution or memory disclosure.
NVD Description
A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current…
more
process.
Deeper analysisAI
CVE-2025-1427, published on 2025-03-13, is an uninitialized variable vulnerability (CWE-457, CWE-908) affecting Autodesk AutoCAD. The issue arises when AutoCAD parses a maliciously crafted CATPRODUCT file, leading to potential exploitation. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H), indicating high confidentiality, integrity, and availability impacts.
A local attacker with low complexity can exploit this vulnerability by tricking a user into opening a malicious CATPRODUCT file within AutoCAD, requiring no privileges but necessitating user interaction. Successful exploitation enables the attacker to crash the application, read sensitive data from memory, or execute arbitrary code in the context of the AutoCAD process.
Autodesk has published security advisory ADSK-SA-2025-0001 addressing this issue. Mitigation involves applying the latest updates for AutoCAD, available through Autodesk's support resources, such as the update download page for AutoCAD and AutoCAD LT 2022. Additional details are provided in Autodesk Access product overview.
Details
- CWE(s)