CVE-2025-1432
Published: 13 March 2025
Summary
CVE-2025-1432 is a high-severity Use After Free (CWE-416) vulnerability in Autodesk Autocad. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 45.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-1432 is a Use-After-Free vulnerability (CWE-416) affecting Autodesk AutoCAD. The issue arises when AutoCAD parses a maliciously crafted 3DM file, which can trigger the vulnerability. Published on 2025-03-13, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
An attacker with local access can exploit this vulnerability by tricking a user into opening a malicious 3DM file through AutoCAD, requiring no special privileges but relying on user interaction. Successful exploitation allows the attacker to cause a denial-of-service crash, read sensitive data from memory, or execute arbitrary code within the context of the AutoCAD process.
Autodesk has issued security advisory ADSK-SA-2025-0001 addressing this vulnerability. Mitigation involves applying the latest updates available through Autodesk's support resources, such as download instructions for AutoCAD and AutoCAD LT updates.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6378
Vulnerability details
A maliciously crafted 3DM file, when parsed through Autodesk AutoCAD, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The Use-After-Free in AutoCAD's 3DM parser directly enables arbitrary code execution upon opening a malicious file, mapping to Exploitation for Client Execution (T1203) and User Execution via Malicious File (T1204.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the Use-After-Free vulnerability by requiring timely application of Autodesk patches for AutoCAD.
Provides memory protections such as ASLR and DEP that mitigate Use-After-Free exploits by preventing reliable code execution or data leakage.
Requires validation of 3DM file inputs to block maliciously crafted files from triggering the parsing flaw in AutoCAD.