Is CVE-2025-10881 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-10881 being exploited in the wild.

How severe is CVE-2025-10881?

High severity, with a CVSS score of 7.8, published 16 December 2025.

Is there a fix for CVE-2025-10881?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-10881 attacked?

It is attacked with local access or over the network.

Am I affected by CVE-2025-10881?

Check whether you run Autodesk , Autodesk 3ds Max, Autodesk Advance Steel or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-10881: Autodesk products heap-based overflow in CATPRODUCT file parsing

CVE-2025-10881 · Severity: high · CVSS 7.8 · Published 2025-12-16

A maliciously crafted CATPRODUCT file can trigger a heap-based overflow in certain Autodesk products when parsed. An attacker can exploit this vulnerability to crash the application, steal sensitive data, or execute arbitrary code with the permissions of the affected user, impacting design workflows and data security.

Technologies: Autodesk <UNKNOWN>, Autodesk 3ds Max, Autodesk Advance Steel, Autodesk AutoCAD, Autodesk Autocad Architecture, Autodesk Autocad Electrical, Autodesk Autocad Map 3d, Autodesk Autocad Mechanical, Autodesk Autocad Mep, Autodesk Autocad Plant 3d, Autodesk Civil 3d, Autodesk Infraworks, Autodesk Inventor, Autodesk Revit, Autodesk Revit Lt, Autodesk Shared Components. Vendors: Autodesk.

Quick answers

Is CVE-2025-10881 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-10881 being exploited in the wild.
How severe is CVE-2025-10881?: High severity, with a CVSS score of 7.8, published 16 December 2025.
Which products and versions are affected?: Autodesk <UNKNOWN>.
Is there a fix for CVE-2025-10881?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-10881 attacked?: It is attacked with local access or over the network.
Am I affected by CVE-2025-10881?: Check whether you run Autodesk <UNKNOWN>, Autodesk 3ds Max, Autodesk Advance Steel or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a heap-based buffer overflow in the CATPRODUCT file parsing functionality of certain Autodesk products. The vulnerability is triggered when a crafted CATPRODUCT file is opened or processed, causing memory corruption in the heap. Attack preconditions include the victim opening a malicious CATPRODUCT file, typically via local or network file access. Successful exploitation allows arbitrary code execution in the context of the Autodesk application process, potentially leading to data exfiltration or lateral movement within the victim's environment. Patch availability is currently unknown based on the advisory text.

Affected products

Autodesk <UNKNOWN>

Timeline

2025-12-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.