CVE-2026-1288
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A maliciously crafted RFA file, when converted to FormIt in Autodesk Revit, can trigger a NULL pointer dereference. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.
Risk Assessment
An attacker can remotely crash Autodesk Revit, disrupting design teams and potentially causing loss of unsaved work.
Recommendation
Immediately update Autodesk Revit to the latest patched version and avoid converting RFA files from untrusted sources.
Other vulnerabilities in Autodesk Revit
See all- CVE-2026-8325High
An Out-of-Bounds Write vulnerability in Autodesk Revit when parsing a maliciously crafted PDF file. It can lead to a crash, data corruption, or arbitrary code execution in the context of the current process.
- CVE-2026-1289High
A Use-After-Free vulnerability in Autodesk Revit when parsing a maliciously crafted PDF file. It can lead to a crash, disclosure of sensitive data, or arbitrary code execution in the context of the current process.
- CVE-2026-11803High
An Out-of-Bounds Read vulnerability in Autodesk Revit when parsing a maliciously crafted PDF file. It can lead to a crash, reading sensitive data, or arbitrary code execution in the context of the current process.
- CVE-2025-8354High
A maliciously crafted RFA file parsed by Autodesk Revit can trigger a type confusion vulnerability. An attacker may leverage this to cause a crash, data corruption, or execute arbitrary code in the context of the current process.
Original NVD description (English source)
A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS