CVE-2025-1275

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A maliciously crafted JPG file, when linked or imported into certain Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-787

Affected software

Vendor	Product	Versions
Autodesk	Revit	>= 2025, < 2025.4.1; >= 2024, < 2024.3.2; >= 2023, < 2023.1.7
Autodesk	AutoCAD	>= 2025, < 2025.1.2; >= 2024, < 2024.1.7; >= 2023, < 2023.1.7
Autodesk	AutoCAD Architecture	>= 2025, < 2025.1.2; >= 2024, < 2024.1.7; >= 2023, < 2023.1.7
Autodesk	AutoCAD Electrical	>= 2025, < 2025.1.2; >= 2024, < 2024.1.7; >= 2023, < 2023.1.7
Autodesk	AutoCAD Mechanical	>= 2025, < 2025.1.2; >= 2024, < 2024.1.7; >= 2023, < 2023.1.7
Autodesk	AutoCAD MEP	>= 2025, < 2025.1.2; >= 2024, < 2024.1.7; >= 2023, < 2023.1.7
Autodesk	AutoCAD Plant 3D	>= 2025, < 2025.1.2; >= 2024, < 2024.1.7; >= 2023, < 2023.1.7
Autodesk	Civil 3D	>= 2025, < 2025.1.2; >= 2024, < 2024.1.7; >= 2023, < 2023.1.7
Autodesk	Advance Steel	>= 2025, < 2025.1.2; >= 2024, < 2024.1.7; >= 2023, < 2023.1.7
Autodesk	AutoCAD MAP 3D	>= 2025, < 2025.1.2; >= 2024, < 2024.1.7; >= 2023, < 2023.1.7
Autodesk	AutoCAD LT	>= 2025, < 2025.1.2; >= 2024, < 2024.1.7; >= 2023, < 2023.1.7
Autodesk	DWG TrueView	>= 2025, < 2025.1.2; >= 2024, < 2024.1.7; >= 2023, < 2023.1.7

References

Timeline

Published: Apr 15, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-127504.9The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to SQL Injection via the 'term' parameter in CVE-2025-127514.3The WSChat – WordPress Live Chat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o CVE-2025-127525.3The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to fake payment creation in all versions up to, and including,CVE-2025-127536.4The Chart Expert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pmzez_chart' shortcode in all versions up to, an CVE-2025-127546.4The Geopost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter of the 'geopost' shortcode in all v CVE-2025-127554.0IBM MQ Operator (SC2 v3.2.0–3.8.1, LTS v2.0.0–2.0.29) and IBM‑supplied MQ Advanced container images (across affected SC2, CD, and LTS 9.3.x–CVE-2025-127564.3Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when delet CVE-2025-127574.6An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to.CVE-2025-127587.5Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the CVE-2025-12767.8A maliciously crafted DWG file, when parsed through certain Autodesk applications, can force an Out-of-Bounds Write vulnerability. A malicio CVE-2025-127605.4Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass.This issue affects Em CVE-2025-127613.5Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Simple multi step form allows C