CVE-2025-10889

CATPART File Parsing Memory Corruption Vulnerability

HIGH

7.8

CVSS Score

Published: December 15, 2025 at 11:43 PM UTC

Updated: October 7, 2026 at 07:10 PM UTC

15 products affected across 1 vendorShared ComponentsAutoCADAutoCAD Electrical

Using Shared Components by Autodesk?

Get instant alerts when new vulnerabilities affect Shared Components - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Shared Components · Autodesk

95%

v < 2026.51.8.0.7 ≤ v < 1.9.0.71.8.0.7

Affected range stops below 1.9.0.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 2026.5, so it looks safe — our inference, not a vendor statement

autodesk-3ds-max (environment) · autodesk-advance-steel (environment) · autodesk-autocad (environment) · autodesk-autocad-architecture (environment) · autodesk-autocad-electrical (environment) · autodesk-autocad-map-3d (environment) · autodesk-autocad-mechanical (environment) · autodesk-autocad-mep (environment) · autodesk-autocad-plant-3d (environment) · autodesk-civil-3d (environment) · autodesk-infraworks (environment) · autodesk-inventor (environment) · autodesk-revit (environment) · autodesk-vault (environment)

3ds Max · Autodeskdevice

80%

All versions

Advance Steel · Autodeskdevice

80%

All versions

AutoCAD · Autodeskdevice

80%

All versions

AutoCAD Architecture · Autodeskdevice

80%

All versions