CVE-2025-1650
Published: 13 March 2025
Summary
CVE-2025-1650 is a high-severity Use of Uninitialized Variable (CWE-457) vulnerability in Autodesk Autocad. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 48.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely application of Autodesk patches directly remediates the uninitialized variable vulnerability in AutoCAD, preventing exploitation via malicious CATPRODUCT files.
Memory protection safeguards like ASLR and DEP mitigate arbitrary code execution and sensitive data disclosure from improper handling of uninitialized variables during file parsing.
Vulnerability scanning identifies deployed AutoCAD versions affected by this uninitialized variable flaw, enabling proactive patching and risk reduction.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in CATPRODUCT file parsing enables client-side exploitation for arbitrary code execution (or memory read/crash) when user opens malicious file.
NVD Description
A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current…
more
process.
Deeper analysisAI
CVE-2025-1650, published on 2025-03-13, is an Uninitialized Variable vulnerability (CWE-457, CWE-908) affecting Autodesk AutoCAD. The issue arises when the software parses a maliciously crafted CATPRODUCT file, leading to improper handling of uninitialized variables within the application.
Attackers with local access can exploit this vulnerability with low complexity and no required privileges, though it requires user interaction such as opening the malicious file. Successful exploitation enables the attacker to crash the AutoCAD process, read sensitive data from memory, or execute arbitrary code in the context of the current process, earning a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Autodesk's security advisory (adsk-sa-2025-0001) addresses this vulnerability, with mitigation available through the latest software updates. Users can download patches for affected versions, including AutoCAD and AutoCAD LT 2022, via official support channels.
Details
- CWE(s)