Autodesk Shared Components contain an Out-of-Bounds Read vulnerability that may allow a local attacker to execute arbitrary code or access sensitive data through malicious file parsing.

This vulnerability is an Out-of-Bounds Read (CWE-125) triggered when the software processes a specially crafted SLDPRT file. The attack requires user interaction to open the malicious file, and the resulting impact occurs within the context of the user process.

The potential for arbitrary code execution and unauthorized data access presents a significant risk to organizational integrity and confidentiality. With a CVSS score of 7.8, this vulnerability is considered high severity, as it could allow an attacker to leverage legitimate software to compromise local systems or exfiltrate sensitive engineering data.

Immediate Action: Update Autodesk Shared Components to version 1.9.0.7 or later as specified in the vendor security advisory.

Proactive Monitoring: Monitor file access logs and endpoint security telemetry for instances of Autodesk applications crashing or behaving unexpectedly when opening third-party files.

Compensating Controls: Implement strict file validation policies and ensure that users only open SLDPRT files from trusted sources to minimize the risk of triggering this vulnerability.

Public Exploit Available: Unknown

Given the severity of potential code execution, administrators should prioritize the deployment of the vendor-provided security updates across all affected Autodesk installations. Ensuring that the Shared Components are updated to version 1.9.0.7 is the only reliable method to mitigate the risk posed by this file parsing vulnerability.