CVE-2026-14479

Executive Summary

CVE-2026-14479 is a local denial-of-service vulnerability in the Autodesk Installer IPC frame parser. A low-privileged local attacker can submit a maliciously crafted input whose embedded position/offset field is not validated, causing an out-of-range substring operation that crashes the installer service running as NT AUTHORITY\SYSTEM. The vulnerability is currently unpatched (confidence 0/4), has no published public exploit code, and is not listed on the CISA KEV — meaning active exploitation is unconfirmed but the availability impact inside affected environments is immediate upon successful trigger.

Technical Analysis

The root cause of CVE-2026-14479 falls under CWE-1285, "Improper Validation of Specified Index, Position, or Offset in Input." The vulnerable component is the IPC frame parser of the Autodesk Installer. Inter-process communication (IPC) frames sent to this service are parsed by a routine that extracts an index, position, or offset value supplied directly by the incoming input. This value is then used to drive a substring extraction operation on a buffer or string held in memory. Because the offset is used without an adequate bounds check against the actual length of the target buffer, an attacker-controlled offset that exceeds the buffer's real size causes the substring operation to read outside the valid range, resulting in an unhandled exception. Since the parser runs inside a service that executes with NT AUTHORITY\SYSTEM privileges, the resulting exception terminates the service process, producing an availability failure at the highest privilege level on the host.

From an attack-surface perspective, the bug is exploitable only locally (AV:L). The attacker requires low privileges (PR:L) — a standard, non-elevated user account or a restricted process — and does not require any user interaction (UI:N). The IPC channel itself is the exposed interface: any local process that can reach the installer service's IPC endpoint can deliver a malformed frame to the parser. The exact transport (named pipe, local socket, or other IPC mechanism) and the frame layout are not disclosed in the NVD description, so no specific protocol offsets, magic bytes, or function names can be referenced with confidence. What is known with certainty is that parsing of attacker-supplied input is the entry point, and that the failure mode is a crash of a SYSTEM-level service.

The vulnerability is both unpatched and, as of the data snapshot, without any vendor advisory that specifies affected product versions or a remediation timeline. The high Availability sub-score (A:H) combined with zero Confidentiality and Integrity impact (C:N/I:N) indicates a pure denial-of-service defect rather than a privilege-escalation or data-exfiltration primitive. The EPSS score of 0.00107 (1.3rd percentile) suggests that, at present, the exploitation likelihood in the wild is low; however, this is a statically derived probability and should not be treated as a guarantee of safety, particularly because local DoS bugs of this class are routinely trivial to weaponize once an attacker has a foothold on a workstation.

Exploitation Scenarios

No public PoC or exploit code exists for CVE-2026-14479, and no nuclei template has been published. The attack chain below is therefore inferred strictly from the vulnerability class (CWE-1285 — improper offset validation in an IPC frame parser) and from the NVD description.

1. Reconnaissance / Target Identification. The attacker must already be present on the target host with low-privileged execution (AV:L, PR:L). Typical initial footholds include malware delivered via phishing, a malicious local user, or an application that the attacker controls running in the current user context. The attacker enumerates running services and processes to identify the Autodesk Installer service (distinguished by its execution as NT AUTHORITY\SYSTEM and its role in software deployment) and locates its IPC interface — for example, by listing local IPC endpoints or by observing the service's memory-mapped structures. No network reconnaissance is required, and no specific endpoint name is published, so this step is driven entirely by local host observation.

2. Triggering the Flaw. The attacker crafts a minimal IPC frame conforming to the parser's expected framing structure and then deliberately sets the frame's position/offset field to a value equal to or greater than the actual size of the payload buffer it references. The frame is delivered to the Autodesk Installer service via the local IPC channel. The parser accepts the frame without validating that the supplied offset is within bounds, because the input-specified position is trusted implicitly.

3. Payload / Execution Method. The payload itself needs no code execution capability and no memory-corruption primitive. It is purely a logical/structural input: an oversized offset embedded in an otherwise well-formed frame. When the parser executes the substring operation using this attacker-controlled offset, the out-of-range read triggers an unhandled exception inside the SYSTEM-level service process. This is a class-level description; the exact mechanism (e.g., the specific substring API, the frame header layout, or the error-handling path) is not disclosed and must not be inferred further.

4. Post-Exploitation Impact. The NT AUTHORITY\SYSTEM installer service terminates unexpectedly, resulting in a denial-of-service condition. Legitimate software installation, update, repair, and uninstall workflows for Autodesk products become unavailable. Because the service terminates as SYSTEM, the impact is not sandboxed to the attacker's own privilege level — the system's own installer capability is disrupted, and on locked-down workstations, repeated triggering can prevent critical patching of Autodesk products. The attack can be replayed indefinitely (no per-attempt state is implied by the description), allowing the attacker to maintain the degraded state. Notably, the flaw provides no confidentiality or integrity gain: the attacker cannot read or modify memory contents beyond the crash, and no privilege escalation is achievable — only service termination.

Impact Assessment

The CVSS v3.1 base score is 5.5 (Medium) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The most material dimension is Availability: the High sub-score (A:H) reflects the crash of a SYSTEM-level service, which can stall or completely block installer operations across the host. Confidentiality and Integrity are marked None (C:N/I:N), meaning there is no data disclosure, no memory-integrity violation, and no code execution derived from this vulnerability. The Scope is Unchanged (S:U), so the blast radius is confined to the single host running the vulnerable Autodesk Installer component.

Business impact depends on the role of the host. For a normal workstation, the primary consequence is interruption of Autodesk product deployment and patching — a nuisance that can, over time, expose the organization to other product-level vulnerabilities if updates cannot be applied. For build servers, CAD/rendering farms, or engineering workstations where Autodesk tooling is business-critical, the crash of the installer service can halt deployment pipelines and block emergency software changes. Additionally, because the attack requires only low privileges, it is a reliable way for a malware operator who has already breached the endpoint to add a stable availability-denial primitive to their arsenal: they can crash a SYSTEM service on demand, disrupting incident-response activities or simply vandalizing a critical engineering asset.

Exploitation in the wild is not confirmed: the CVE is absent from CISA's Known Exploited Vulnerabilities catalog, and the EPSS percentile of 1.3% corroborates low current weaponization. However, the unpatched state and the conceptual simplicity of crafting an oversized offset in an IPC frame mean that security teams should treat this as a latent, easily activatable availability risk rather than an exotic one.

Detection Guidance

Detection of CVE-2026-14479 is complicated by the fact that the vulnerability is exercised entirely through local IPC and manifests as a process crash. Network-based sensors (Suricata) will have limited direct visibility; the most effective detection signals are Windows Service Control Manager termination events and Windows Error Reporting (WER) application-crash events. The rules below are heuristic and should be tuned to the verified service name once Autodesk publishes a security advisory.

Sigma Rule

title: Autodesk Installer Service Unexpected Termination - Possible CVE-2026-14479
id: 5e9a25c1-1447-4a01-9b2e-6c8124a9f001
status: experimental
description: Detects unexpected termination of the Autodesk Installer service, a failure
    signature consistent with CVE-2026-14479 IPC frame parser denial-of-service.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-14479
author: Valters IT SOC
date: 2026/05/15
tags:
    - attack.t1499
    - cve.2026.14479
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID:
            - 7031   # Service terminated unexpectedly
            - 7034   # Service terminated unexpectedly
        Message|contains:
            - 'Autodesk'
    condition: selection
falsepositives:
    - Legitimate service restarts performed by administrators
    - Crash-loop recovery after a failed Autodesk product update
level: high

YARA Rule

rule CVE_2026_14479_Autodesk_Installer_IPC_Malformed_Input
{
    meta:
        author = "Valters IT SOC"
        description = "Heuristic detection of input files that may carry malformed offset fields targeting the Autodesk Installer IPC frame parser (CVE-2026-14479). Tune to actual file format once advisory is published."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-14479"
        date = "2026-05-15"
        score = 40
    strings:
        $a1 = "Autodesk" ascii wide nocase
        $a2 = "Installer" ascii wide nocase
        $a3 = "IPC" ascii wide nocase
        // Repeated 0xFFFFFFFF values are a weak heuristic for oversized offset fields
        $bad_off = { FF FF FF FF }
    condition:
        filesize < 50MB
        and 1 of ($a*)
        and #bad_off >= 3
}

Note: this YARA rule is deliberately generic. The real installer/update file format is not disclosed; analysts should re-tune the rule once Autodesk publishes the affected component details or if a sample is recovered.

Suricata IDS Rule

Because the attack occurs over local IPC, a network sensor captures only the pre-existing workstation traffic (e.g., SMB named-pipe sessions if IPC is transported over SMB). The following rule is a best-effort network-layer heuristic for SMB sessions referencing Autodesk components; host-based telemetry is the authoritative detection source.

alert smb any any -> any any (msg:"ET HUNTING CVE-2026-14479 Autodesk Installer IPC SMB Session Suspicious"; flow:established,to_server; content:"Autodesk"; nocase; classtype:attempted-dos; sid:2026144791; rev:1; metadata:created_at 2026_05_15, updated_at 2026_05_15;)

Analyst note: without the IPC endpoint name, this rule only flags SMB session context. Expect significant false positives; rely on the Sigma/EQL rules for the actual crash signal.

Elastic Detection

// EQL: Autodesk installer service crash events (SCM)
any where event.code in ("7031", "7034")
  and (winlog.event_data.param1 like "*Autodesk*"
       or winlog.event_data.param2 like "*Autodesk*")

// EQL: Repeated crashes within 15 minutes => likely active DoS attempt
sequence with maxspan=15m
  [ any where event.code == "7031" and winlog.event_data.param1 like "*Autodesk*" ]
  [ any where event.code == "7031" and winlog.event_data.param1 like "*Autodesk*" ]
  [ any where event.code == "7031" and winlog.event_data.param1 like "*Autodesk*" ]

Splunk SPL Query

index=windows source="WinEventLog:System" (EventCode=7031 OR EventCode=7034) "Autodesk"
| bin _time span=5m
| stats count as crash_count by host, _time, Message
| where crash_count >= 3
| sort - _time

This correlation flags three or more Autodesk installer-service crashes within a five-minute window, which is a strong indicator of repeated exploitation attempts rather than an isolated software fault.

Wazuh OSSEC Rule

<rule id="100479" level="12">
  <if_sid>600</if_sid>
  <match>Autodesk</match>
  <regex>terminated unexpectedly|service-specific error</regex>
  <description>CVE-2026-14479: Autodesk Installer service terminated unexpectedly - potential local IPC denial-of-service exploitation.</description>
  <group>autodesk_dos,attack.t1499,</group>
</rule>

Mitigation & Patch Guidance

Patch confidence is 0/4: no tracked source has published a patch, a vendor fix, or an official workaround. The following guidance is therefore layered across immediate hardening, patch readiness, and long-term posture.

1. Immediate mitigations (no vendor fix required):

• Restrict local access to hosts running Autodesk Installer. Since the vulnerability requires low-privileged local execution (PR:L), the fastest risk reduction is to minimize the number of interactive local accounts and ensure standard users cannot run arbitrary processes on high-value engineering workstations.
• Monitor the installer service's stability. Enable Windows Error Reporting and configure alerting on Service Control Manager events 7031/7034 for the Autodesk service; treat repeated crashes as an active DoS signal.
• If feasible on managed fleets, disable or set the Autodesk installer service to manual start in environments where installation/update activity is infrequent. Do not do this on endpoints where automatic patching of Autodesk products is required.
• Block untrusted local execution paths: enforce application whitelisting and restrict write access to user-writable directories that could host a malicious local payload.

2. Patch / upgrade steps (pending vendor action):

• No patch is currently available. Subscribe to Autodesk's Trust Center and security-advisory RSS feeds so that the eventual fix and affected-version details are captured immediately.
• When a fix is published, test it on a representative engineering workstation (including one connected to installer/update distribution infrastructure) before fleet-wide rollout.
• Track CVE-2026-14479 status in your vulnerability-management platform with a recurring review cadence — the patch confidence of 0/4 means this CVE must not be auto-closed.

3. Long-term hardening:

• Enforce least privilege across the endpoint fleet; no user should have administrative rights on shared engineering assets, and low-privileged users should be assumed to have a path to a local DoS primitive such as this one.
• Deploy host-based telemetry (EDR) with IPC- and crash-event monitoring so that anomalies in local inter-process communication and SYSTEM-service terminations are visible even when network sensors cannot see them.
• Rehearse incident response for "SYSTEM-service crash loop" scenarios: define which team restores the installer service, how to capture a memory dump of the crashing process for vendor triage, and how to preserve any malicious IPC frames for forensic analysis.
• Periodically reassess the EPSS and CISA KEV status of this CVE; a rise in EPSS or a KEV listing should trigger immediate priority escalation.

References

1. NIST NVD — CVE-2026-14479: https://nvd.nist.gov/vuln/detail/CVE-2026-14479
2. Autodesk Trust Center (Security Advisories — monitor for future vendor update): https://www.autodesk.com/trust/security-advisories
3. MITRE CWE-1285 — Improper Validation of Specified Index, Position, or Offset in Input: https://cwe.mitre.org/data/definitions/1285.html
4. MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/

No threat-actor campaigns, exploit-in-the-wild reports, or CISA KEV listings are associated with this CVE at the time of writing. The absence of a known exploit should not reduce vigilance, given the unpatched state and the low complexity of the underlying offset-validation flaw.