CVE-2025-1274

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A maliciously crafted RCS file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Apr 15, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-127407.7A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML, cause Looker to exeCVE-2025-127417.7A Looker user with Developer role could create a database connection using Denodo driver and, by manipulating LookML, cause Looker to executCVE-2025-127427.5A Looker user with a Developer role could cause Looker to execute a malicious command, due to insecure processing of Teradata driver parametCVE-2025-127436.0The Looker endpoint for generating new projects from database connections allows users to specify "looker" as a connection name, which is a CVE-2025-127448.8A flaw was found in the ABRT daemon’s handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input anCVE-2025-127457.8A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. This affects the function js_array_buffer_slice ofCVE-2025-127466.1The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and inclCVE-2025-127475.3The Tainacan plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via uploaded files markeCVE-2025-127485.5A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before CVE-2025-12757.8A maliciously crafted JPG file, when linked or imported into certain Autodesk applications, can force a Heap-Based Overflow vulnerability. ACVE-2025-127504.9The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to SQL Injection via the 'term' parameter in CVE-2025-127514.3The WSChat – WordPress Live Chat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o