An out-of-bounds write vulnerability in Autodesk Shared Components poses a significant risk of arbitrary code execution for users who open malicious MODEL files.

This vulnerability is a CWE-787 out-of-bounds write flaw triggered by the parsing of a maliciously crafted MODEL file. Successful exploitation requires user interaction, such as opening a file, and allows an attacker to execute arbitrary code within the context of the current process.

The potential for arbitrary code execution creates a high risk of system compromise, data theft, or unauthorized persistence within the user's environment. Given the CVSS score of 7.8, this flaw is categorized as high severity because it enables attackers to gain control over local systems, leading to potential lateral movement or damage to proprietary design data stored within Autodesk applications.

Immediate Action: Update Autodesk Shared Components to version 1.9.0.7 or later as specified in the official Autodesk security advisory.

Proactive Monitoring: Review system logs for unusual application crashes or process behavior occurring shortly after users import or open external files.

Compensating Controls: Implement strict file handling policies, including the use of endpoint protection software to scan incoming files from untrusted sources before they are processed by Autodesk software.

Public Exploit Available: No (exploit_available: false)

Organizations should prioritize the deployment of the provided security update across all workstations running affected Autodesk products. Users should avoid opening MODEL files from untrusted or unknown sources until the patch is applied, as this remains the primary vector for exploitation.