CVE-2026-1289
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A Use-After-Free vulnerability in Autodesk Revit when parsing a maliciously crafted PDF file. It can lead to a crash, disclosure of sensitive data, or arbitrary code execution in the context of the current process.
Risk Assessment
A malicious PDF opened in Revit could enable an attacker to disclose data or execute code, threatening system confidentiality and integrity.
Recommendation
Update Autodesk Revit to a patched version and exercise caution when opening PDFs from unknown sources.
Other vulnerabilities in Autodesk Revit
See all- CVE-2026-8325High
An Out-of-Bounds Write vulnerability in Autodesk Revit when parsing a maliciously crafted PDF file. It can lead to a crash, data corruption, or arbitrary code execution in the context of the current process.
- CVE-2026-11803High
An Out-of-Bounds Read vulnerability in Autodesk Revit when parsing a maliciously crafted PDF file. It can lead to a crash, reading sensitive data, or arbitrary code execution in the context of the current process.
- CVE-2026-1288Medium
A maliciously crafted RFA file, when converted to FormIt in Autodesk Revit, can trigger a NULL pointer dereference. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.
- CVE-2025-8354High
A maliciously crafted RFA file parsed by Autodesk Revit can trigger a type confusion vulnerability. An attacker may leverage this to cause a crash, data corruption, or execute arbitrary code in the context of the current process.
Original NVD description (English source)
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS