CVE-2026-14255
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to cause the application to terminate unexpectedly, resulting in a denial-of-service. Exploitation requires a user to open a specially crafted IFC file.
Risk Assessment
The risk includes application crashes and potential service unavailability, potentially impacting productivity and business continuity.
Recommendation
Avoid opening IFC files from untrusted sources and apply security updates provided by Autodesk.
Other vulnerabilities in Autodesk products
See all- CVE-2026-7406High
Untrusted Pointer Dereference vulnerability when parsing a malicious BMP file in certain Autodesk products. Could allow arbitrary code execution.
- CVE-2025-10889High
A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Original NVD description (English source)
A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to cause the application to terminate unexpectedly, resulting in a denial-of-service. Exploitation requires a user to open a specially crafted IFC file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS