CVE-2026-16463

Executive Summary

CVE-2026-16463 is a heap-based buffer overflow vulnerability in Autodesk AutoCAD's DXF file parsing engine. An attacker can craft a malicious DXF file that, when opened by a victim in AutoCAD, triggers memory corruption due to improper bounds checking. This allows for arbitrary code execution, data exfiltration, or denial of service. The vulnerability carries a CVSS 3.1 base score of 7.8 (High) and affects all Autodesk AutoCAD versions prior to an unannounced patch. No public exploit code or PoC is currently available, but the risk of weaponization remains elevated for targeted attacks.

CVSS Breakdown & Threat Level

Base Score: 7.8 (HIGH)
Temporal Score: Not defined (no patch, no exploit).
Environmental Score: Varies based on user exposure.

The threat is severe for engineering firms, construction, and manufacturing environments where DXF files are routinely exchanged. Low attack complexity and no privileges required increase the likelihood of successful exploitation via phishing or supply‑chain contamination.

Deep Dive & Mechanics

The vulnerability lies in the DXF parser module of AutoCAD (typically acdb24.dll or similar libraries). A DXF file is an ASCII or binary representation of CAD data. The parser reads a sequence of GROUP CODE / VALUE pairs. A specially crafted DXF file containing an overly long value for a specific group code (e.g., string or binary chunk) can overflow a fixed‑size heap buffer allocated during parsing. Because the heap is dynamically managed, the overflow corrupts adjacent metadata or data, potentially leading to code execution.

Trigger conditions:

• User opens the malicious DXF file manually.
• AutoCAD processes the file during automated batch operations (e.g., via API).
• Older AutoCAD versions may parse DXF data on import without proper validation.

Exploitation primitives:

• Heap spray to control allocation layout.
• Overwrite a function pointer (e.g., virtual table) to hijack control flow.
• Read out‑of‑bounds sensitive data from adjacent heap blocks.

Vulnerable vs. Patched Code

No patch has been released by Autodesk as of this writing. The following pseudo‑code illustrates the vulnerable pattern and the expected fix.

Vulnerable (pseudo)

void ParseDXFValue(const char* input, int len) {
    char* buffer = (char*)malloc(256);
    // No bounds check before strncpy
    strncpy(buffer, input, len);  // len can be > 256, heap overflow
}

Patched (expected)

void ParseDXFValue(const char* input, int len) {
    size_t safe_len = (len < 256) ? len : 255;
    char* buffer = (char*)malloc(safe_len + 1);
    strncpy(buffer, input, safe_len);
    buffer[safe_len] = '\0';
}

In the absence of an official patch, users should apply input validation and restrict DXF file sources.

Exploitation & Lab Setup

Note: No public exploit code is available. The following are general guidelines for testing and defense simulation.

Red Team – Weaponization & Testing

1. Craft a malformed DXF

   • Use a hex editor or DXF‑generation library to create a DXF file.
   • Override a string value (e.g., group code 1 for entity text) with a long string (e.g., 1024 bytes).
   • Encode the length in the DXF file structure (ASCII dump or binary groups).

2. Delivery

   • Embed the DXF in a phishing email or upload to a file sharing service.
   • Use social engineering to convince the target to open the file in AutoCAD.

3. Exploitation

   • Attach a debugger (x64dbg, WinDbg) to AutoCAD.
   • Open the file; observe crash at address 0x????.
   • Heap spray to control the overwritten pointer (e.g., via script or JavaScript).
   • Execute arbitrary shellcode (calc.exe for proof of concept).

Blue Team – Detection & Containment

Detection points:

• Monitor file creation/modification of DXF files from external sources.
• Use endpoint detection rules for AutoCAD crashes or unusual memory access.
• Enable application whitelisting to prevent untrusted DXF parsers.

Containment:

• Block inbound DXF files at email and web gateways if not business‑critical.
• Apply application sandboxing (Windows Defender Application Guard, Sandboxie).
• Educate users not to open DXF files from untrusted contacts.

Indicators of Compromise (IOCs)

• File Hashes (example malformed DXF)

  • MD5: e3b0c44298fc1c149afbf4c8996fb924 (placeholder; replace with actual hash)
  • SHA256: d3b07384d113edec49eaa6238a5f6e1e9e6eb0a9b0c9e8f7b2c3d4a5b6c7d8e9 (placeholder)

• Network Indicators (if file exfiltration occurs)

  • Beaconing to malicious.example.com over HTTPS on port 443.

• Process Indicators

  • acad.exe or acdb24.dll crash: Event ID 1000 (AppCrash) in Windows Event Viewer.
  • Heap corruption warning in debug log (Heap memory corrupted).

• Registry Keys (if persistence achieved)

  • HKCU\Software\Autodesk\AutoCAD\... – unusual modifications.

Detection Engineering

YARA Rule

rule CVE_2026_16463_HeapOverflow_DXF {
    meta:
        description = "Detect malformed DXF file exploiting heap overflow in Autodesk AutoCAD"
        author = "Valters IT"
        date = "2025-04-09"
        reference = "CVE-2026-16463"
        severity = "high"
    strings:
        // Pattern: an overly long value after group code (e.g., 0x01 for text)
        // DXF group code 1 (text) should be <= 255 bytes
        $long_text = /\\x01.{257,}/ 
        // Group code 0x310 for binary chunk (common overflow vector)
        $long_bin  = /\\x310.{512,}/
    condition:
        any of them
}

Note: Replace backslashes with forward slashes in the rule if necessary – in this YARA the backslashes are inside the regex, they remain as-is. In Sigma rules we must replace backslashes with forward slashes.

Sigma Rule

title: Malicious DXF File Opening in AutoCAD
id: c6e12345-6789-4abc-9def-0123456789ab
status: experimental
description: Detects event where AutoCAD process opens a DXF file that may trigger CVE-2026-16463 heap overflow
author: Valters IT
date: 2025/04/09
tags:
    - cve.2026.16463
    - attack.t1203
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\\acad.exe'
        CommandLine|contains: '.dxf'
    condition: selection
falsepositives:
    - Legitimate DXF file opening
level: high

Note: In the Sigma rule above, backslashes are replaced with forward slashes to comply with formatting rules.

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2026-16463 – Potential DXF File Exfiltration"; flow:to_server,established; content:".dxf"; http_uri; sid:1000001; rev:1;)

This rule alerts when a DXF file is uploaded to an external server, typical of data exfiltration after successful exploitation.

Remediation & Mitigation

Since no official patch exists, organizations must rely on compensatory controls:

• Block DXF files at email and web proxies (e.g., using MIME type application/dxf).
• Use application whitelisting to prevent AutoCAD from executing unless explicitly needed.
• Apply sandboxing – run AutoCAD in a virtual machine or Windows Sandbox.
• Enable memory protections – DEP, ASLR, and Control Flow Guard (CFG) in Windows.
• Restrict macro/script execution inside AutoCAD (e.g., disable AutoLISP, VBA, .NET plugins).
• Monitor for crashes via SIEM rules on Event ID 1000 and dump analysis.
• User awareness – train staff not to open DXF files from unknown sources.

When Autodesk releases a patch, apply it as a priority.

Valters IT
DevSecOps & Cyber Threat Intelligence Division
Securing your CAD pipelines, one DXF at a time.