{"id":"CVE-2022-25790","url":"https://www.cyber-defence.io/tools/cve/CVE-2022-25790","generatedAt":"2026-10-27T19:05:19.007Z","title":"A maliciously crafted DWF file in Autodesk AutoCAD 2022, 2021, 2020, 2019 and Autodesk Navisworks 2022 can be used to write beyond the allocated boundaries when parsing the DWF files.","description":"A maliciously crafted DWF file in Autodesk AutoCAD 2022, 2021, 2020, 2019 and Autodesk Navisworks 2022 can be used to write beyond the allocated boundaries when parsing the DWF files. Exploitation of this vulnerability may lead to code execution.","published":"2022-04-11T20:15:21.000Z","lastModified":"2026-06-17T04:34:17.000Z","status":"Modified","sourceIdentifier":"psirt@autodesk.com","cvss":{"version":"3.1","score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"cwe":["CWE-787"],"affected":["autodesk/advance steel","autodesk/autocad","autodesk/autocad architecture","autodesk/autocad electrical","autodesk/autocad lt","autodesk/autocad map 3d","autodesk/autocad mechanical","autodesk/autocad mep","autodesk/autocad plant 3d","autodesk/civil 3d","autodesk/navisworks"],"epss":{"score":0.01562,"percentile":0.75087,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (1.56%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0005","tags":["Vendor Advisory"],"source":"psirt@autodesk.com"},{"url":"https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0005","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-25790","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}