CVE-2026-1289
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Use-After-Free vulnerability in Autodesk Revit when parsing a maliciously crafted PDF file. An attacker can leverage this to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process.
Risk Assessment
A user opening a malicious PDF file could lead to data confidentiality breach or system compromise.
Recommendation
Update Autodesk Revit to the latest patched version. Do not open PDF files from untrusted sources.
Other vulnerabilities in Autodesk Revit
See all- CVE-2026-8325High
Out-of-Bounds Write vulnerability when parsing a malicious PDF in Autodesk Revit. Can cause crash, data corruption, or arbitrary code execution.
- CVE-2026-11803High
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
- CVE-2026-1288Medium
A maliciously crafted RFA file, when converted to FormIt in Autodesk Revit, can trigger a NULL pointer dereference. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.
Original NVD description (English source)
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process.