Patch & vulnerability status
Autodesk Revit
Release status, tracked CVEs, and automated cross-platform patching for Autodesk Revit.
| Platform | Latest version | CVEs tracked | Last checked |
|---|---|---|---|
| Windows | 61 | 2024-05-23 |
Known vulnerabilities (CVEs) in Autodesk Revit
Lavawall tracks 61 published CVEs affecting Autodesk Revit, and deploys the versions that fix them automatically across your fleet.
| CVE | Published | Severity | Details | Vector |
|---|---|---|---|---|
| CVE-2026-1288 | 2026-06-17 17:16:43 | MEDIUM (6) | A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition. | LOCAL |
| CVE-2026-0875 | 2026-02-18 20:18:32 | HIGH (8) | A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2026-0874 | 2026-02-18 20:18:32 | HIGH (8) | A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-9460 | 2025-12-16 00:16:04 | HIGH (8) | A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-9459 | 2025-12-16 00:16:04 | HIGH (8) | A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-9458 | 2025-11-07 18:15:38 | HIGH (8) | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-9457 | 2025-12-16 00:16:04 | HIGH (8) | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-9456 | 2025-12-16 00:16:03 | HIGH (8) | A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-9455 | 2025-12-16 00:16:03 | HIGH (8) | A maliciously crafted CATPRODUCT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-9454 | 2025-12-16 00:16:03 | HIGH (8) | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-9453 | 2025-12-16 00:16:03 | HIGH (8) | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-9452 | 2025-12-16 00:16:03 | HIGH (8) | A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-8894 | 2025-09-16 15:15:47 | HIGH (8) | A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-8893 | 2025-09-16 15:15:47 | HIGH (8) | A maliciously crafted PDF file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-8892 | 2025-09-22 19:16:28 | HIGH (8) | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-8354 | 2025-09-23 14:15:42 | HIGH (8) | A maliciously crafted RFA file, when parsed through Autodesk Revit, can force a Type Confusion vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-7675 | 2025-07-29 18:15:33 | HIGH (8) | A maliciously crafted 3DM file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-7497 | 2025-07-29 18:15:33 | HIGH (8) | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-6637 | 2025-07-29 18:15:33 | HIGH (8) | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-6636 | 2025-07-29 18:15:32 | HIGH (8) | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-6635 | 2025-07-29 18:15:32 | HIGH (8) | A maliciously crafted PRT file, when linked or imported into certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-6631 | 2025-07-29 18:15:32 | HIGH (8) | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-5043 | 2025-07-29 18:15:32 | HIGH (8) | A maliciously crafted 3DM file, when linked or imported into certain Autodesk products, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-5042 | 2025-07-22 16:15:34 | HIGH (8) | A maliciously crafted RFA file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-5040 | 2025-07-10 12:15:24 | HIGH (8) | A maliciously crafted RTE file, when parsed through Autodesk Revit, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-5039 | 2025-07-24 17:15:33 | HIGH (8) | A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context of the current process due to an untrusted search path being utilized. | LOCAL |
| CVE-2025-5038 | 2025-07-29 18:15:32 | HIGH (8) | A maliciously crafted X_T file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-5037 | 2025-07-10 12:15:23 | HIGH (8) | A maliciously crafted RFA, RTE, or RVT file, when parsed through Autodesk Revit, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-5036 | 2025-06-02 17:15:44 | HIGH (8) | A maliciously crafted RFA file, when linked or imported into Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-2497 | 2025-04-15 21:15:57 | HIGH (8) | A maliciously crafted DWG file, when parsed through Autodesk Revit, can cause a Stack-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-1656 | 2025-04-15 21:15:48 | HIGH (8) | A maliciously crafted PDF file, when linked or imported into Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-14593 | 2025-12-16 00:16:02 | HIGH (8) | A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-1277 | 2025-04-15 21:15:47 | HIGH (8) | A maliciously crafted PDF file, when parsed through Autodesk applications, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-1276 | 2025-04-15 21:15:47 | HIGH (8) | A maliciously crafted DWG file, when parsed through certain Autodesk applications, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-1275 | 2025-04-15 21:15:47 | HIGH (8) | A maliciously crafted JPG file, when linked or imported into certain Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-1274 | 2025-04-15 21:15:47 | HIGH (8) | A maliciously crafted RCS file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-1273 | 2025-04-15 21:15:47 | HIGH (8) | A maliciously crafted PDF file, when linked or imported into Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-10900 | 2025-12-16 00:16:01 | HIGH (8) | AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-10899 | 2025-12-16 00:16:01 | HIGH (8) | AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-10898 | 2025-12-16 00:16:01 | HIGH (8) | AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-10889 | 2025-12-16 00:16:01 | HIGH (8) | A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-10888 | 2025-12-16 00:16:01 | HIGH (8) | AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-10887 | 2025-12-16 00:16:01 | HIGH (8) | A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-10886 | 2025-12-16 00:16:00 | HIGH (8) | A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-10884 | 2025-12-16 00:16:00 | HIGH (8) | AA maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-10883 | 2025-12-16 00:16:00 | HIGH (8) | A maliciously crafted CATPRODUCT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-10882 | 2025-12-16 00:16:00 | HIGH (8) | AA maliciously crafted X_T file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2025-10881 | 2025-12-16 00:15:59 | HIGH (8) | A maliciously crafted CATPRODUCT file, when parsed through certain Autodesk products, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2024-7994 | 2024-10-16 22:15:03 | HIGH (8) | A maliciously crafted RFA file, when parsed through Autodesk Revit, can force a Stack-Based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2024-7993 | 2024-10-16 22:15:03 | HIGH (8) | A maliciously crafted PDF file, when parsed through Autodesk Revit, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2024-11608 | 2024-12-09 18:15:23 | HIGH (8) | A maliciously crafted SKP file, when linked or imported into Autodesk Revit, can be used to cause a Heap-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | LOCAL |
| CVE-2024-11454 | 2024-12-09 18:15:22 | HIGH (8) | A maliciously crafted DLL file, when placed in the same directory as an RVT file could be loaded by Autodesk Revit, and execute arbitrary code in the context of the current process due to an untrusted search patch being utilized. | LOCAL |
| CVE-2024-11268 | 2024-12-09 18:15:22 | MEDIUM (6) | A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read. A malicious actor can leverage this vulnerability to cause a crash or could lead to an arbitrary memory leak. | LOCAL |
| CVE-2023-25004 | 2023-06-27 19:15:09 | HIGH (8) | A maliciously crafted pskernel.dll file in Autodesk products is used to trigger integer overflow vulnerabilities. Exploitation of these vulnerabilities may lead to code execution. | LOCAL |
| CVE-2023-25003 | 2023-06-23 19:15:09 | HIGH (8) | A maliciously crafted pskernel.dll file in Autodesk AutoCAD 2023 and Maya 2022 may be used to trigger out-of-bound read write / read vulnerabilities. Exploitation of this vulnerability may lead to code execution. | LOCAL |
| CVE-2023-25002 | 2023-06-27 23:15:10 | HIGH (8) | A maliciously crafted SKP file in Autodesk products is used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution. | LOCAL |
| CVE-2022-27871 | 2022-06-21 15:15:09 | HIGH (8) | Autodesk AutoCAD product suite, Revit, Design Review and Navisworks releases using PDFTron prior to 9.1.17 version may be used to write beyond the allocated buffer while parsing PDF files. This vulnerability may be exploited to execute arbitrary code. | LOCAL |
| CVE-2021-40166 | 2022-10-07 18:15:15 | HIGH (8) | A maliciously crafted PNG file in Autodesk Image Processing component may be used to attempt to free an object that has already been freed while parsing them. This vulnerability may be exploited by attackers to execute arbitrary code. | LOCAL |
| CVE-2021-40165 | 2022-10-07 18:15:15 | HIGH (8) | A maliciously crafted TIFF, PICT, TGA, or RLC file in Autodesk Image Processing component may be used to write beyond the allocated buffer while parsing TIFF, PICT, TGA, or RLC files. This vulnerability may be exploited to execute arbitrary code. | LOCAL |
| CVE-2021-40163 | 2022-10-07 18:15:14 | HIGH (8) | A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through Autodesk Image Processing component. | LOCAL |
| CVE-2021-40162 | 2022-10-07 18:15:14 | HIGH (8) | A maliciously crafted TIF, PICT, TGA, or RLC files in Autodesk Image Processing component may be forced to read beyond allocated boundaries when parsing the TIFF, PICT, TGA, or RLC files. This vulnerability may be exploited to execute arbitrary code. | LOCAL |
Why keeping Autodesk Revit patched matters
Unpatched third-party applications are one of the most common ways attackers get in: 57% of breached MSP clients and 32% of ransomware cases trace back to a missing patch. Every Autodesk Revit release that fixes a security bug is public, so attackers see it too, and an out-of-date install becomes a documented way in. Tracking the installed version on every machine and closing the gap quickly is what turns a disclosed CVE into a non-event.
How Lavawall® patches Autodesk Revit
Lavawall® watches Autodesk Revit releases and CVEs continuously, ranks each update by risk, and deploys it across your whole fleet, Windows, macOS, and Linux, from a single agent, independently of your RMM. You get one place to see which machines are behind on Autodesk Revit, one policy to bring them current, and timestamped evidence for audits.
Frequently asked questions
What is the latest version of Autodesk Revit?
Lavawall tracks Autodesk Revit (last checked 2024-05-23). New releases are monitored continuously and can be deployed automatically across your fleet.
Lavawall tracks Autodesk Revit (last checked 2024-05-23). New releases are monitored continuously and can be deployed automatically across your fleet.
Does Autodesk Revit have known security vulnerabilities (CVEs)?
Lavawall tracks 61 CVEs for Autodesk Revit and remediates them automatically as part of patching.
Lavawall tracks 61 CVEs for Autodesk Revit and remediates them automatically as part of patching.
How do I patch Autodesk Revit automatically?
Deploy the Lavawall® agent and Autodesk Revit updates are applied automatically across Windows, macOS, and Linux, risk-ranked and reported, independently of your RMM.
Deploy the Lavawall® agent and Autodesk Revit updates are applied automatically across Windows, macOS, and Linux, risk-ranked and reported, independently of your RMM.
Lavawall® monitors releases and CVEs for Autodesk Revit through public information and proprietary statistical analysis, and can patch it automatically across your fleet.