CVE-2025-8354

{
  "id": "CVE-2025-8354",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-23T14:15:41.597",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A maliciously crafted RFA file, when parsed through Autodesk Revit, can force a Type Confusion vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
    },
    {
      "lang": "es",
      "value": "Un archivo RFA creado maliciosamente, cuando es analizado por Autodesk Revit, puede forzar una vulnerabilidad de confusión de tipos. Un actor malicioso puede aprovechar esta vulnerabilidad para causar un fallo, causar corrupción de datos o ejecutar código arbitrario en el contexto del proceso actual."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Autodesk",
          "product": "Revit",
          "defaultStatus": "unaffected",
          "cpes": [
            "cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:*",
            "cpe:2.3:a:autodesk:revit:2025:*:*:*:*:*:*:*",
            "cpe:2.3:a:autodesk:revit:2024:*:*:*:*:*:*:*"
          ],
          "versions": [
            {
              "version": "2026",
              "lessThan": "2026.3",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "2025",
              "lessThan": "2025.4.4",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "2024",
              "lessThan": "2024.3.4",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Autodesk",
          "product": "Revit LT",
          "defaultStatus": "unaffected",
          "cpes": [
            "cpe:2.3:a:autodesk:revit_lt:2026:*:*:*:*:*:*:*",
            "cpe:2.3:a:autodesk:revit_lt:2025:*:*:*:*:*:*:*",
            "cpe:2.3:a:autodesk:revit_lt:2024:*:*:*:*:*:*:*"
          ],
          "versions": [
            {
              "version": "2026",
              "lessThan": "2026.3",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "2025",
              "lessThan": "2025.4.4",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "2024",
              "lessThan": "2024.3.4",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-24T03:55:16.087083Z",
          "id": "CVE-2025-8354",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-843"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2026",
              "versionEndExcluding": "2026.3",
              "matchCriteriaId": "F1EA8A6E-9199-42C0-A807-952406DA952C"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.autodesk.com/products/autodesk-access/overview",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0021",
      "source": "[email protected]"
    }
  ]
}