CVE-2026-11803

Executive Summary

CVE-2026-11803 is a high-severity Out-of-Bounds Read vulnerability in Autodesk Revit's PDF file parsing functionality, carrying a CVSS score of 7.8. A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read condition that allows a malicious actor to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. The vulnerability requires user interaction (opening a malicious PDF within Revit), operates with local attack vector but no privileges, and impacts confidentiality, integrity, and availability at a high level. As of the current patch status assessment, no vendor patch or fix has been confirmed from any tracked source (patch confidence 0/4), making this an unpatched vulnerability that enterprise environments using Autodesk Revit should treat with elevated urgency.

Technical Analysis

CVE-2026-11803 is classified under CWE-125, which denotes an Out-of-Bounds Read condition. The vulnerability resides in the PDF file parsing module of Autodesk Revit, a building information modeling (BIM) software widely used in architecture, engineering, and construction industries.

Vulnerability Mechanism: The flaw manifests when Revit's internal PDF parser processes a crafted PDF file. The parser fails to properly validate memory boundaries when reading data from the PDF structure, resulting in an Out-of-Bounds Read. This means the parsing routine attempts to access memory locations outside the intended buffer, reading data from adjacent memory regions. The malformed PDF can be constructed by manipulating specific PDF structural elements—such as cross-reference tables, object streams, or page tree entries—to reference offsets that exceed the expected file structure boundaries.

Attack Surface: The attack surface is the PDF import functionality within Autodesk Revit. Revit supports PDF insertion for reference purposes within building models, allowing users to link or import PDF documents as underlays or reference sheets. When a user opens or imports a PDF file, the parser processes the file's internal structure, including object dictionaries, streams, and metadata. An attacker can craft a PDF where certain object references point to invalid memory offsets, triggering the Out-of-Bounds Read when the parser dereferences these pointers.

Technical Details: The vulnerability is triggered during the parsing phase, specifically when the application reads data from PDF structures. Because the flaw is an Out-of-Bounds Read rather than an Out-of-Bounds Write, the primary exploitation goals are: (1) causing a denial-of-service condition via application crash when the parser reads unmapped memory, (2) leaking sensitive process memory data that could be returned in error messages or subsequent processing, and (3) potentially corrupting control-flow data if the out-of-bounds read results are used in subsequent operations such as function pointer resolution or offset calculations, which could lead to arbitrary code execution.

Attack Vector Characteristics: The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates: Local attack vector (AV:L)—the attacker must deliver the malicious PDF to the target system and convince the user to open it in Revit; Low attack complexity (AC:L)—no special conditions are required beyond crafting the malicious PDF; No privileges required (PR:N)—the attacker does not need any authenticated access; User interaction required (UI:R)—the victim must open the malicious file; Scope unchanged (S:U)—the compromise is contained to the Revit process and its memory space; High confidentiality impact (C:H)—sensitive process memory data can be read; High integrity impact (I:H)—potential for arbitrary code execution; High availability impact (A:H)—crash or full control of the process possible.

Exploitation Scenarios

The following attack chain describes a realistic exploitation scenario for CVE-2026-11803. While no public proof-of-concept has been confirmed, the exploitation path is derived from the vulnerability class and the application's functional capabilities.

Step 1: Reconnaissance and Target Identification The attacker identifies organizations utilizing Autodesk Revit—typically architecture firms, construction companies, engineering consultancies, and government agencies involved in building and infrastructure projects. Reconnaissance involves: scanning for job postings, project documentation, or public portfolios that mention Revit usage; identifying project collaboration portals, BIM coordination platforms, or email distribution lists where PDF files are commonly exchanged; and profiling the target's document workflow to determine how PDFs are ingested into Revit (e.g., direct import, linked files, embedded references).

Step 2: PDF Weaponization The attacker crafts a malicious PDF file designed to exploit the Out-of-Bounds Read. The weaponization process involves:

• Constructing a valid PDF document with a standard header, body containing various objects (catalog, pages, content streams), and a cross-reference table.
• Modifying object length fields, stream offsets, or dictionary entries to point to invalid memory addresses beyond the allocated buffer boundaries.
• Specifically targeting the objects that Revit's PDF parser is known to process first—typically the document catalog and page tree—to ensure the malformed structure is encountered early in the parsing sequence.
• Embedding the malicious PDF in a convincing container: a project specification document, a vendor submittal, a structural calculation sheet, or a site survey report—all file types commonly exchanged with Revit-based projects.
• Optionally, compressing the PDF with obfuscation techniques to evade basic static detection tools.

Step 3: Delivery and User Interaction The attacker delivers the malicious PDF via the most likely vector for the target's workflow:

• Email phishing with an attached PDF disguised as a legitimate project document (e.g., "BuildingCodeUpdates.pdf", "StructuralSpecifications_Rev01.pdf").
• Uploading the PDF to a shared project folder on SharePoint, Dropbox, or a BIM 360 platform that the target team uses for collaboration.
• Posting the PDF on industry forums, supplier portals, or project bid sites that architects and engineers routinely access. The victim is induced to open the PDF within Autodesk Revit, either through the Insert → Import PDF function or by dragging the file into the Revit workspace to create a linked reference.

Step 4: Exploitation Execution When Revit's PDF parser processes the malicious file:

• The parser reads the cross-reference table and attempts to access objects at attacker-controlled offsets.
• The Out-of-Bounds Read triggers, causing the parser to read memory beyond the file buffer.
• Two potential outcomes occur depending on the crafted payload:
  • Denial-of-Service: The parser reads unmapped memory, causing an access violation and crashing the Revit process, leading to potential loss of unsaved work.
  • Data Exfiltration: The parser reads adjacent memory containing sensitive data (e.g., other open document contents, credentials in memory, architectural data from other loaded models) and the data is included in parser error messages or subsequent processing output that the attacker could observe or retrieve.
  • Code Execution Potential: The out-of-bounds read feeds corrupted data into subsequent memory operations. If the attacker can shape memory layout (e.g., via heap grooming with other opened documents), the corrupted read values could influence function pointer resolution or offset arithmetic, potentially redirecting execution flow to attacker-controlled code.

Step 5: Post-Exploitation Impact Post-exploitation impact depends on the exploitation outcome:

• Crash (Availability): Repeated crashes disrupt project workflows, cause data loss from unsaved models, and require IT intervention—significant in deadline-driven construction environments.
• Data Leakage (Confidentiality): The attacker obtains fragments of process memory, which may include proprietary design data, client information, authentication tokens for connected Autodesk services, or credentials for network resources.
• Code Execution (Integrity): If arbitrary code execution is achieved, the attacker operates with the privileges of the logged-in user, enabling: installation of backdoors or persistence mechanisms; lateral movement to other networked workstations; exfiltration of entire Revit project files containing sensitive architectural plans; and potential supply-chain compromise if the compromised Revit environment is used to generate deliverables for other parties.

Impact Assessment

Business Impact: This vulnerability poses a significant risk to organizations in the architecture, engineering, and construction (AEC) sector. The CVSS score of 7.8 (High) reflects the combination of high confidentiality, integrity, and availability impacts. The attack requires only a local file drop and user interaction—no privileges or special conditions are needed, making the barrier to exploitation low.

Affected Systems: All Autodesk Revit installations that support PDF import/linking functionality are potentially affected. This includes: Revit Architecture, Revit Structure, Revit MEP, and Revit LT; long-term support (LTS) releases as well as the annual subscription versions; versions deployed on Windows workstations—both standalone and networked installations; and virtualized environments where Revit is accessed via remote desktop or VDI.

Blast Radius: The blast radius extends beyond the immediate Revit process due to: the sensitivity of architectural and engineering data managed within Revit—confidential building plans, structural calculations, MEP layouts—which are high-value targets for corporate espionage or physical infrastructure targeting; the collaborative nature of construction projects where Revit files are shared with contractors, sub-contractors, and clients, meaning a compromised template or imported file could propagate; potential lateral movement from an infected workstation into the broader corporate network—Revit workstations are often domain-joined and have access to file servers, project management systems, and email; and supply-chain risks where compromised Revit environments produce deliverables (e.g., IFC exports, DWG conversions) that could be further weaponized.

CVSS Subscore Analysis: With a base score of 7.8, the most notable subscores are: Impact sub-score of 5.9—near-maximum impact signalling that all three security pillars (C:H/I:H/A:H) are highly affected; no attack complexity barrier (AC:L) and no privilege requirement (PR:N) means the only mitigating factor is that it requires user interaction and a local attack vector. The exploitability sub-score of 1.9 is limited, not by security controls, but by the requirement for delivering the malicious file and convincing a user to open it.

EPSS and KEV Status: EPSS has not yet been scored by FIRST.org (no predictive exploitation likelihood score exists). The vulnerability is NOT listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no confirmed in-the-wild exploitation has been reported to CISA at the time of assessment.

Detection Guidance

Detection of CVE-2026-11803 exploitation requires monitoring both endpoint behavior (file handling, application crashes) and network activity (malicious PDF delivery). The following detection rules address these vectors.

Sigma Rule

title: Autodesk Revit PDF Parsing Out-of-Bounds Read Attempt
id: 9b3f6e2a-14c7-4d5e-9f8a-6b2c1d4e5f60
status: experimental
description: Detects suspicious PDF files with malformed structure being opened or processed by Autodesk Revit, potentially indicating exploitation of CVE-2026-11803
author: Valtersit Threat Intelligence
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-11803
logsource:
    category: process_creation
    product: windows
detection:
    selection_revit:
        Image|endswith:
            - '\Revit.exe'
            - '\RevitLT.exe'
    selection_pdf_extension:
        CommandLine|contains:
            - '.pdf'
            - '.PDF'
    selection_crash_indication:
        CommandLine|contains:
            - '/crash'
            - '/recover'
            - 'Autodesk Revit has encountered a problem'
    selection_import_function:
        CommandLine|contains:
            - 'ImportPDF'
            - 'LinkPDF'
            - 'PDFUnderlay'
    condition: selection_revit and selection_pdf_extension or (selection_revit and selection_crash_indication)
    timeframe: 5m
level: high
falsepositives:
    - Legitimate PDF import workflows within Revit
    - Users linking reference PDFs to project documents
    - Normal crash recovery after application failure
tags:
    - attack.initial-access
    - attack.t1204
    - cve.2026-11803

YARA Rule

rule CVE_2026_11803_Revit_PDF_Exploit_KB {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects PDF files with malformed cross-reference structures targeting Autodesk Revit Out-of-Bounds Read vulnerability"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-11803"
        severity = "high"
    strings:
        $pdf_header = "%PDF-" nocase
        $xref_anomaly = { 78 72 65 66 0D 0A }  // "xref" followed by CRLF
        $startxref_early = { 73 74 61 72 74 78 72 65 66 20 30 }  // "startxref 0" anomaly
        $trailer_missing = { 74 72 61 69 6C 65 72 }  // "trailer"
        $object_stream = { 2F 4F 62 6A 53 74 6D }  // "/ObjStm"
        $large_offset = { 73 74 61 72 74 78 72 65 66 20 [4-8] (FF FF FF FF | 7F FF FF FF) }  // startxref with huge offset
        $revit_marker = { 72 76 69 74 5F 70 64 66 }  // "revit_pdf"
    condition:
        uint16(0) == 0x2525 and $pdf_header and (
            ($startxref_early and $trailer_missing) or
            ($large_offset) or
            ($object_stream and $xref_anomaly)
        ) and filesize > 1KB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-11803 - Autodesk Revit Malicious PDF Download Attempt"; flow:established,to_client; content:"%PDF-"; http.response_body; pcre:"/%PDF-\d+\.\d+/"; content:"xref"; http.response_body; pcre:"/xref\\s+\\d+\\s+\\d+/"; content:"startxref"; http.response_body; pcre:"/startxref\\s+(\\d{8,}|0x[0-9a-fA-F]{6,})/"; classtype:attempted-user; sid:500011803; rev:1; reference:cve,2026-11803; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-11803;)

alert smtp any any -> any any (msg:"CVE-2026-11803 - Phishing PDF with Malformed Structure via Email"; flow:established,to_client; content:"%PDF-"; file_data; content:"xref"; file_data; pcre:"/xref[^\\r\\n]*\\r?\\n/"; content:"startxref"; file_data; pcre:"/startxref\\s+(\\d{8,})/"; filestore; classtype:attempted-user; sid:500011804; rev:1; reference:cve,2026-11803;)

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-11803 - PDF Upload to External Location (Potential Exfiltration)"; flow:established,to_server; content:"%PDF-"; http.request_body; file_data; content:"startxref"; file_data; pcre:"/startxref\\s+(\\d{8,}|0x[0-9a-fA-F]{6,})/"; classtype:attempted-exfiltration; sid:500011805; rev:1; reference:cve,2026-11803;)

Elastic Detection

// EQL Query to detect malicious PDF processing in Autodesk Revit (Elastic EQL)
sequence by process.entity_id
  [process where event.action == "start" and
   process.name : ("Revit.exe", "RevitLT.exe") and
   process.args : ("*.pdf", "*.PDF")]
  [file where event.action == "open" and
   file.extension : ("pdf", "PDF") and
   file.path : ("C:\\Users\\*\\AppData\\Local\\Temp\\*", "C:\\Users\\*\\Downloads\\*", "C:\\Users\\*\\Documents\\*") and
   file.size > 10000]
  [process where event.action == "end" and
   process.name : ("Revit.exe", "RevitLT.exe") and
   process.exit_code != 0]

// Additional query for crash events correlated with PDF activity
sequence by host.name with maxspan=10m
  [process where event.action == "start" and
   process.name : ("Revit.exe", "RevitLT.exe") and
   process.args : ("*.pdf", "*.PDF")]
  [event where event.dataset == "endpoint.events.system" and
   winlog.event_id : (1000, 1001, 7034) and
   winlog.provider_name : "Application Error"]

// Query for anomalous PDF file headers (oversized offset values)
file where event.action in ("open", "modification") and
file.extension == "pdf" and
process.name : ("Revit.exe", "RevitLT.exe") and
file.size > 100000

Splunk SPL Query

index=windows_xmlwineventlog OR index=endpoint OR index=security
| search "Revit.exe" OR "RevitLT.exe"
| rex field=CommandLine "(?i)(?<pdf_path>.*\.pdf)"
| stats count BY _time, host, user, CommandLine, pdf_path
| where count > 0

| eventstats max(_time) as last_activity BY host
| search (SourceName="Application Error" OR SourceName="Windows Error Reporting") 
  EventCode IN (1000,1001)
| rex field=Message "(?i)Revit\.exe"
| table _time, host, Message, EventCode, SourceName
| sort -_time

// Combined SPL for full detection workflow
index=all sourcetype="WinEventLog:Application" OR sourcetype="XmlWinEventLog:Application"
| join type=outer EventCode [ search index=all sourcetype IN ("WinEventLog:Security", "Sysmon")
    | search (Image="*Revit*" OR Image="*RevitLT*") CommandLine="*.pdf*"
    | table host Image CommandLine ParentImage]
| search (EventCode=1000 OR EventCode=1001 OR EventCode=7034)
| table _time, host, Image, CommandLine, Message
| eval classify = if(CommandLine LIKE "%.pdf%", "PDF related crash", "Non-PDF crash")
| stats count BY classify, host

Wazuh OSSEC Rule

<group name="autodesk,revit,pdf,vulnerability,">
    <!-- Detect Revit PDF processing attempts -->
    <rule id="100178" level="8">
        <decoded as="command">CommandLine</decoded>
        <match>Revit.exe|RevitLT.exe</match>
        <regex>.+\.pdf|.+\.PDF</regex>
        <description>CVE-2026-11803: Suspected PDF file being processed by Autodesk Revit</description>
        <group>vulnerability,exploit_attempt,</group>
        <mitre>
            <id>T1204</id>
        </mitre>
    </rule>

    <!-- Detect Revit Application Error events -->
    <rule id="100179" level="10" frequency="2" timeframe="300">
        <if_sid>100178</if_sid>
        <match>Application Error|Windows Error Reporting</match>
        <regex>Revit\.exe</regex>
        <description>CVE-2026-11803: Autodesk Revit crash associated with PDF processing detected</description>
        <group>exploit_attempt,denial_of_service,</group>
        <mitre>
            <id>T1499</id>
        </mitre>
    </rule>

    <!-- Detect network delivery of potential malicious PDF -->
    <rule id="100180" level="6">
        <if_sid>40020</if_sid>
        <match>%PDF-</match>
        <regex>xref.*startxref</regex>
        <description>CVE-2026-11803: Malicious PDF structure detected in network traffic</description>
        <group>exploit_attempt,cve-2026-11803,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source has been identified. The Affected Versions field is empty, and no vendor fix or workaround has been published by Autodesk at the time of assessment.

1) Immediate Mitigations (Until Patch is Available)

• Restrict PDF Import Functionality: Implement application-level controls to disable or restrict PDF import in Revit environments where it is not essential. This can be achieved through: Revit installation customization via a customized Revit.ini file; Group Policy Objects (GPO) to disable the functionality if supported by Autodesk configuration; or deploying a hardened Revit template that removes PDF import commands from all project templates.
• Implement File Allowlisting: Deploy application allowlisting (e.g., Microsoft AppLocker or Windows Defender Application Control) to block execution of Revit if the application attempts to parse PDF files outside of approved directories.
• Email and Web Filtering: Enhance email gateway filtering to quarantine PDF attachments from external senders, particularly those associated with project-related subject lines or sender domains not in the organization's approved vendor list. Deploy web filtering to block downloads of PDF files from untrusted domains.
• Enforce User Awareness: Issue immediate security advisories to all Revit users alerting them to the vulnerability and instructing them to: not open PDF files from untrusted sources; verify the legitimacy of PDF attachments via alternative communication (phone call, direct verification); and report any suspicious PDF files to the security team.
• Monitor for Anomalous Behavior: Implement the detection rules provided above across SIEM, EDR, and network monitoring platforms, with heightened alerting thresholds during business hours when Revit usage is expected.

2) Patch/Upgrade Steps

As no patch is currently available (verified via NVD, vendor advisories, and OSV package tracking), the following steps should be performed:

• Automated Monitoring: Configure automated daily checks for Autodesk security advisories and the NVD entry for CVE-2026-11803 to detect patch availability the moment it is released.
• Vendor Subscription: Ensure your organization has an active Autodesk subscription or maintenance plan to receive priority notification and expedited access to security patches.
• Test Plan Preparation: Develop and rehearse a patch deployment plan for the Autodesk Revit environment, including: staging and test environments that mirror production configurations; rollback procedures in case of compatibility issues; and communication templates for user notification.
• Patch Deployment Strategy: Once a fix is released, prioritize deployment to: workstations used by high-value targets (executives, project leads); workstations with direct network access to project servers; and any systems with elevated privileges or access to sensitive project data. Deploy via centralized patch management (SCCM, Intune, or Autodesk Desktop App) in a phased rollout—pilot group first, then business units, then remaining users.

3) Long-Term Hardening

• Network Segmentation: Ensure Revit workstations are not directly reachable from the internet. Place them in a segmented VLAN with strict firewall policies limiting ingress/egress traffic to only necessary services (e.g., project servers, licensing servers, trusted update services).
• Least Privilege Architecture: Run Revit with the lowest privilege level required. Avoid granting administrative privileges to users on Revit workstations. If the organization requires elevated rights for certain Revit operations, use separate accounts or controlled elevation tools (e.g., privilege separation).
• Endpoint Hardening: Apply security baseline configurations to Revit workstations: enable Memory Integrity (HVCI) to prevent known-kernel exploits from executing; enable exploit protection features in Windows Defender (e.g., DEP, ASLR, CFG) and ensure the application is compatible with hardened mitigations; implement Credential Guard to protect process credentials.
• Application Isolation: Consider using Windows Sandbox or application virtualization (e.g., App-V) for PDF import operations during the unpatched window. Alternatively, deploy Revit in a dedicated virtualized environment for untrusted project files.
• Vendor Relationship Management: Establish a point of contact with Autodesk's security response team to receive direct notifications about vulnerabilities affecting AEC software. Engage in the vendor's security advisory mailing list and consider participating in their coordinated disclosure program if applicable.
• Supply Chain Controls: Implement a secure file exchange protocol for all incoming project files, including PDFs. Scan all files in a sandboxed environment before allowing distribution to business units. Verify checksums or digital signatures for files from external partners.
• Regular Vulnerability Scanning: Integrate Autodesk Revit into the organization's regular vulnerability scanning program. Use authenticated scans that detect the specific Revit version installed and cross-reference against CVE databases for known vulnerabilities.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-11803 — Official National Vulnerability Database entry providing the CVE description, CVSS vector information, and CWE classification.
2. CWE-125 Out-of-Bounds Read: https://cwe.mitre.org/data/definitions/125.html — MITRE CWE definition of the Out-of-Bounds Read weakness class, providing technical context on the vulnerability mechanism.
3. Autodesk Security Center: https://www.autodesk.com/trust/security-advisories — Official Autodesk security advisories page where future patch announcements for CVE-2026-11803 will be published. Monitor this page for vendor fix availability.
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CISA KEV catalog. CVE-2026-11803 is not currently listed; however, this should be monitored for updates if the vulnerability is subsequently exploited in the wild.
5. MITRE ATT&CK T1204 — User Execution: https://attack.mitre.org/techniques/T1204/ — Attack technique reference relevant to the exploitation scenario requiring user interaction to trigger the malicious PDF parsing.

Threat Actor Campaigns and In-the-Wild Exploitation: As of the assessment date, there is no evidence of active exploitation campaigns, zero-day attacks, or inclusion in exploit-kit weaponizations for CVE-2026-11803. EPSS has not been scored by FIRST.org, and the CISA KEV catalog does not include this CVE. The lack of public proof-of-concept and the unpatched status suggest the vulnerability remains in a discovery/disclosure phase. Organizations should treat the absence of in-the-wild exploitation as a window for proactive mitigation rather than an indication of reduced risk, particularly given the high potential for data breach impact in AEC-sector targets.