CVE-2026-11803
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Risk Assessment
An attacker could gain access to sensitive data or take control of the Revit process, potentially leading to system integrity compromise and data leakage.
Recommendation
It is recommended to update Autodesk Revit to the latest version with security patches and avoid opening PDF files from untrusted sources.
Other vulnerabilities in Autodesk Revit
See all- CVE-2026-8325High
Out-of-Bounds Write vulnerability when parsing a malicious PDF in Autodesk Revit. Can cause crash, data corruption, or arbitrary code execution.
- CVE-2026-1289High
Use-After-Free vulnerability in Autodesk Revit when parsing a maliciously crafted PDF file. An attacker can leverage this to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process.
- CVE-2026-1288Medium
A maliciously crafted RFA file, when converted to FormIt in Autodesk Revit, can trigger a NULL pointer dereference. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.
Original NVD description (English source)
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.