CVE-2025-10898

HighCVSS 7.8/10Last modified Oct 19, 2026

Description

A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Dec 16, 2025
Last modified: Oct 19, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-108997.8AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A maliciou CVE-2025-109007.8AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A maliciou CVE-2025-109014.3The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ai CVE-2025-109024.3The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ai_s CVE-2025-109036.5GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that CVE-2025-109054.4Collision in MiniFilter driver in Avast Software Avast Free Antivirus before 25.9 on Windows allows a local attacker with administrative p CVE-2025-109068.4A flaw has been found in Magnetism Studios Endurance up to 3.3.0 on macOS. This affects the function loadModuleNamed:WithReply of the file /CVE-2025-109077.2An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination i CVE-2025-109087.3Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Lin CVE-2025-109092.4A security flaw has been discovered in Mangati NovoSGA up to 2.2.9. The impacted element is an unknown function of the file /admin of the co CVE-2025-10914.3A Broken Authorization schema exists where any authenticated user could download IOA script and configuration files if the URL is known.CVE-2025-109109.3A flaw in the binding process of Govee’s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the