CVE-2025-8354
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A maliciously crafted RFA file parsed by Autodesk Revit can trigger a type confusion vulnerability. An attacker may leverage this to cause a crash, data corruption, or execute arbitrary code in the context of the current process.
Risk Assessment
This may lead to application instability, data loss, or malicious code execution on the user's workstation.
Recommendation
Update Autodesk Revit to a patched version and avoid opening RFA files from untrusted sources.
Other vulnerabilities in Autodesk Revit
See all- CVE-2026-8325High
An Out-of-Bounds Write vulnerability in Autodesk Revit when parsing a maliciously crafted PDF file. It can lead to a crash, data corruption, or arbitrary code execution in the context of the current process.
- CVE-2026-1289High
A Use-After-Free vulnerability in Autodesk Revit when parsing a maliciously crafted PDF file. It can lead to a crash, disclosure of sensitive data, or arbitrary code execution in the context of the current process.
- CVE-2026-11803High
An Out-of-Bounds Read vulnerability in Autodesk Revit when parsing a maliciously crafted PDF file. It can lead to a crash, reading sensitive data, or arbitrary code execution in the context of the current process.
- CVE-2026-1288Medium
A maliciously crafted RFA file, when converted to FormIt in Autodesk Revit, can trigger a NULL pointer dereference. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.
Original NVD description (English source)
A maliciously crafted RFA file, when parsed through Autodesk Revit, can force a Type Confusion vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS