CVE-2025-5047
Autodesk Advance Steel 2026
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2025-5047 is a high-severity Use of Uninitialized Variable (CWE-457) vulnerability in Autodesk Advance Steel. Its CVSS base score is 7.8 (High).
Operationally, ranked at the 8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-16 (Memory Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-25034
Vulnerability Data
A maliciously crafted DGN file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current…
more
process.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation of untrusted DGN file contents before AutoCAD parsing, directly blocking the malformed input that triggers the uninitialized-variable flaw.
Applies memory-protection mechanisms that detect or block use of uninitialized variables during DGN processing, preventing crashes, data disclosure, or code execution.
Requires integrity verification of AutoCAD binaries and input files, enabling detection of tampering that could exploit the uninitialized-variable condition.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly catch uninitialized-variable defects via static analysis and code review while the control encompasses many additional development controls.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect uninitialized-variable bugs, but the control is broader.
Secure development life cycle mandates practices that reduce uninitialized-variable defects.
Application security requirements can specify initialization rules, but the control itself does not directly address the weakness.
Secure coding explicitly requires variable initialization and static-analysis checks.
Secure architecture principles encourage defensive coding that can mitigate uninitialized variables.