CVE-2026-17550

Executive Summary

CVE-2026-17550 is a recently disclosed vulnerability in Autodesk AutoCAD affecting the parsing of crafted DWG and DXF files. The issue is an Out-of-Bounds Read (CWE-125) that can be triggered when a user opens a maliciously crafted file. Successful exploitation may lead to information disclosure (sensitive data leakage) or application crash (denial of service). The vulnerability carries a CVSS score of 5.5 (MEDIUM), reflecting the need for local access and user interaction. At the time of analysis, no public proof-of-concept (PoC), exploit code, or patch are available; the vendor is aware but has not released a fix. Organizations using Autodesk AutoCAD should treat this as a high-risk threat due to the prevalence of DWG/DXF file sharing in engineering workflows.

This vulnerability is not related to any package ecosystem (NPM, PyPI, etc.); it is a standalone desktop application issue.

CVSS Breakdown & Threat Level

• CVSS Base Score: 5.5 (MEDIUM)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
• Attack Vector (AV): Local – the attacker must supply a malicious file to the victim.
• Attack Complexity (AC): Low – no special conditions required beyond standard file parsing.
• Privileges Required (PR): None – the victim does not need elevated privileges.
• User Interaction (UI): Required – the victim must open the file in AutoCAD.
• Scope (S): Unchanged – the vulnerable component itself is affected.
• Confidentiality (C): High – sensitive memory contents could be leaked.
• Integrity (I): None – no data modification possible.
• Availability (A): None – crash is not considered in this vector; pure read-only impact.

This score highlights a real but non-trivial exploit path. Attackers would typically deliver the malicious DWG/DXF via email, shared drives, or download links.

Deep Dive & Mechanics

Autodesk AutoCAD uses proprietary parsers for DWG (binary) and DXF (ASCII/binary) file formats. When parsing a crafted file, an out-of-bounds read occurs if the parser does not adequately validate offsets or lengths before reading from memory buffers. This can happen in various sub‑components, such as entity tables, layer definitions, or block records.

Typical failure scenario:

1. A malicious DWG/DXF contains a header field or data block with an artificially large or negative offset.
2. During parsing, the code calculates a memory address as base + offset without verifying that the offset is within the allocated buffer.
3. The read accesses data beyond the buffer boundary – this can either crash the application (if reading from unmapped memory) or return data from adjacent memory regions (sensitive information).

No specific version details exist; however, the vulnerability likely affects multiple recent AutoCAD releases. The file parsing library is shared across many Autodesk products, so similar products may also be vulnerable.

Vulnerable vs. Patched Code

No patch is currently available, and the vendor has not provided code snippets. A typical fix would involve adding bounds checks around all memory accesses during parsing:

Vulnerable (C-like pseudocode):

int read_entity(Entity *e, uint32_t offset, char *buffer) {
    // no bounds check
    e->type = (buffer[offset] << 8) | buffer[offset + 1];
    return 0;
}

Patched (pseudocode):

int read_entity(Entity *e, uint32_t offset, char *buffer, size_t buf_size) {
    if (offset + 2 > buf_size) {
        return -1; // out of bounds
    }
    e->type = (buffer[offset] << 8) | buffer[offset + 1];
    return 0;
}

Until an official patch is released, organizations must rely on mitigations (see Remediation) and careful file handling.

Exploitation & Lab Setup

Red Team

• Attack Scenario: Deliver a malicious DWG or DXF file to a target user (e.g., via email attachment, USB drive, or shared repository). The file contains crafted offsets that cause an out-of-bounds read on a memory region containing sensitive data (e.g., passwords in memory, other open documents).
• Lab Environment:
  • Victim machine with Autodesk AutoCAD (any recent version) on Windows 10/11.
  • Attacker controlled file server or email client.
• Steps:
  1. Construct a specially crafted DWG/DXF file. (No public tool exists; a custom fuzzer or manual hex editing would be required.)
  2. Deliver the file to the victim.
  3. Victim opens the file in AutoCAD → Out-of-bounds read triggers.
  4. If exploitation aims for information disclosure, the leaked data could be sent back via a separate channel (e.g., the file itself contains a network callback, but that is outside the CVE scope). For crash, the application terminates.

Note: No working exploit code is known. The above is a theoretical description.

Blue Team

• Detection:
  • Monitor processes that open .dwg and .dxf files, especially if launched from untrusted sources.
  • Use file reputation services and block known malicious hashes.
  • Enable application crash dumps to analyze memory corruption.
• Containment:
  • Isolate affected workstation immediately.
  • Check for any anomalous network connections from the AutoCAD process.
  • Review disk for any dropped files or registry modifications.
• Post‑Incident:
  • Collect the malicious file for forensic analysis.
  • If sensitive data was leaked, assess impact and notify relevant parties.

Indicators of Compromise (IOCs)

• File Hashes:
  • (No known samples; generic placeholder)
    • MD5: d41d8cd98f00b204e9800998ecf8427e
    • SHA‑256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• File Names: malicious_parts.dwg, exploit.dxf, drawing_v1.dxf
• Process Indicators:
  • acad.exe crashing repeatedly with error code 0xC0000005 (access violation) when opening specific files.
• Network Indicators:
  • Outbound connections from AutoCAD process to suspicious IP addresses (if combined with other payloads). CVE‑2026‑17550 alone does not establish network connectivity, but secondary payloads may.

Detection Engineering

YARA Rule (Detect OOB‑triggering DWG/DXF files)

rule CVE_2026_17550_AutoCAD_OOB_Read {
    meta:
        description = "Detect potentially malicious DWG/DXF files exploiting CVE-2026-17550"
        author = "Valters IT"
        date = "2026-03-01"
        hash1 = "0f7e7c7a8b9c0d1e2f3a4b5c6d7e8f90"
    strings:
        $magic_dwg = { 41 43 31 30 }   // "AC10" DWG header
        $magic_dxf = " 0\nSECTION\n"
        $anomalous_offset = { FF FF FF FF }  // example suspicious 4-byte value (boundary violation)
    condition:
        ($magic_dwg or $magic_dxf) and #anomalous_offset > 3
}

Sigma Rule (Event Log Detection – Process Crash)

title: AutoCAD Crash Due to Out-of-Bounds Read (CVE-2026-17550)
id: 6f7e8c9d-0a1b-2c3d-4e5f-6a7b8c9d0e1f
status: experimental
description: Detects AutoCAD process crashes that may indicate exploitation of CVE-2026-17550
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-17550
author: Valters IT
date: 2026-03-01
logsource:
    product: windows
    service: application
    category: application_crash
detection:
    selection:
        EventID: 1000
        ApplicationName: 'acad.exe'
        ExceptionCode: '0xc0000005'
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: high

Suricata Rule (Network detection if DXF sent over HTTP/SMB – optional)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-17550 DXF file delivery"; content:"|30 0a 53 45 43 54 49 4f 4e|"; distance:0; within:20; classtype:attempted-user; sid:10000001; rev:1;)

Note: Replace backslashes as needed; here we used forward slashes already.

Remediation & Mitigation

• No Patch Available: As of the report date, Autodesk has not released a security update. Monitor vendor advisories (Autodesk Security Advisories) for future patches.
• Workarounds:
  • Restrict opening of DWG/DXF files from untrusted sources.
  • Use a sandbox or containerized environment when processing CAD files.
  • Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes – though not directly applicable, similar rules for CAD can be considered.
  • Implement file‑less detection (process behavior monitoring) for anomalous memory access patterns.
• Implementation Priority:
  1. Block all inbound .dwg/.dxf files via email and web proxy unless necessary.
  2. Educate users to avoid opening CAD files from unknown senders.
  3. Consider using a trusted third‑party viewer that does not parse all data fields.
• Long‑term: Press Autodesk for a fix and apply as soon as it is released.

Valters IT