CVE-2026-0875
Published: 18 February 2026
Summary
CVE-2026-0875 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Autodesk Shared Components. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 10.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the out-of-bounds write vulnerability in Autodesk products by applying vendor-provided patches from security advisory ADSK-SA-2026-0004.
Implements memory safeguards such as ASLR and DEP to protect against exploitation of out-of-bounds write memory corruption leading to code execution or crashes.
Requires validation of MODEL file inputs to ensure they conform to expected format and size, mitigating risks from maliciously crafted files before parsing.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in file parser enables client-side arbitrary code execution via malicious MODEL file opened by user (T1204.002); directly matches exploitation for client execution (T1203).
NVD Description
A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the…
more
current process.
Deeper analysisAI
CVE-2026-0875 is an Out-of-Bounds Write vulnerability (CWE-787) affecting certain Autodesk products. The issue arises when these products parse a maliciously crafted MODEL file, potentially leading to memory corruption. Published on 2026-02-18, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high impact with local attack vector, low complexity, no privileges required, and user interaction needed.
A local attacker can exploit this vulnerability by providing a specially crafted MODEL file and convincing a user to open it within an affected Autodesk product. Successful exploitation allows the attacker to cause a denial-of-service via application crash, data corruption, or arbitrary code execution in the context of the current process.
Autodesk has published security advisory ADSK-SA-2026-0004 with details on affected products and mitigation steps, available at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0004. Additional product information is provided at https://www.autodesk.com/products/autodesk-access/overview.
Details
- CWE(s)