CVE-2026-7406

Executive Summary

CVE-2026-7406 is a high-severity Untrusted Pointer Dereference vulnerability (CWE-822) that affects multiple Autodesk products when parsing maliciously crafted BMP image files. An attacker who successfully exploits this flaw can execute arbitrary code in the context of the current process, achieving full compromise of the affected workstation or server. The vulnerability requires a victim to open or process a crafted BMP file, making phishing and malicious file delivery the primary initial access vectors. As of this report, no vendor patch has been identified, no known exploit code exists publicly, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog.

Technical Analysis

Vulnerability Mechanism

The flaw resides in the BMP parsing routines of certain Autodesk products. When a file is opened, the image parser dereferences a pointer that is derived from data embedded within the BMP file itself, without sufficient validation of the pointer's target address. This is classified as CWE-822: Untrusted Pointer Dereference.

A standard BMP file consists of a file header (BITMAPFILEHEADER), an information header (BITMAPINFOHEADER), and pixel data. The vulnerability is triggered when the parser encounters malformed fields such as:

• Negative or oversized biHeight / biWidth values — leading to incorrect memory offset calculations.
• Corrupted bfOffBits — the byte offset to pixel data, which the parser trusts without bounds checking.
• Invalid biCompression values — causing the parser to jump to attacker-controlled memory addresses.
• Forged palette or color table pointers — when the parser dereferences these pointers, it may read from or write to an arbitrary address.

The core issue is that certain code paths in the BMP decoder use raw file data (header fields) to compute a memory address, and then dereference that address directly. An attacker who knows the memory layout of the target process can place values in the BMP header that cause the parser to dereference a controlled address, leading to arbitrary code execution.

Attack Surface

• Local attack vector — the attacker must convince a user to open a malicious BMP file in an affected Autodesk application.
• Affected modules — any Autodesk product with a built-in BMP parser, which includes but is not limited to AutoCAD, Revit, Inventor, and various DWF/Design Review tools.
• Privilege context — code executes with the privileges of the current user. If the user is an administrator, full system compromise is possible.

CVSS Breakdown (per the assigned vector)

• AV:L / AC:L / PR:N / UI:R / S:U / C:H / I:H / A:H = 7.8 (High)
• CIA Impact: All three are High, reflecting the potential for complete confidentiality, integrity, and availability loss on the target host.

Exploitation Scenarios

While no public PoC or in-the-wild exploitation has been confirmed, the following attack chain represents the most likely exploitation path for an attacker:

Step 1: Reconnaissance and Target Identification

An attacker identifies organizations that rely on Autodesk products (architecture, engineering, construction, manufacturing, media & entertainment). LinkedIn, Shodan with banner data, or direct B2B scouting helps pinpoint targets. The attacker may also compromise a third-party supplier or manufacturer who regularly sends CAD/DXF/BMP files to the target (supply-chain deflection).

Step 2: Weaponization

The attacker crafts a malicious BMP file:

1. Generates a valid BMP with a known-good header.
2. Modifies the bfOffBits field (offset 10 in the file header) to a value that will be used as a pointer base.
3. Manipulates biSizeImage and biClrUsed to control heap layout and force predictable allocation patterns (heap spraying).
4. Embeds a shellcode payload — decoupled from the header — in the pixel data region, placed at a predictable offset from the heap base.
5. Sets the pointer field within the BMP header to point directly to the embedded shellcode, exploiting the Untrusted Pointer Dereference.

Step 3: Delivery and Trigger

1. The malicious BMP is named to appear benign (e.g., drawing_ref.bmp, site_plan_2026.bmp) and delivered via:
   • Phishing email with a ZIP attachment.
   • Compromised project-share sites (BIM 360, SharePoint, local file shares).
   • USB drop in a physical facility.
2. The victim opens the file in an affected Autodesk application.
3. The BMP parser reads header fields, computes an address, and dereferences it.
4. EIP (or RIP) is redirected to the attacker-controlled pointer, executing the shellcode in-process.

Step 4: Post-Exploitation

1. Privilege escalation — if the current process is running as a standard user, the attacker attempts UAC bypass or exploits a local EoP to gain SYSTEM privileges.
2. Lateral movement — the attacker uses the compromised workstation as a foothold, moves laterally across CAD workstations, servers, and file repositories, potentially stealing proprietary design documents, building blueprints, or industrial schematics.
3. Persistence — installs a loader or backdoor disguised as an AutoLISP/plug-in script for Autodesk products.
4. Exfiltration — sensitive design data is staged and exfiltrated via encrypted channels to C2 infrastructure.

Impact Assessment

Business Impact

• Confidentiality: High — An attacker can steal proprietary design files, customer blueprints, and intellectual property, which is the core asset of architecture, engineering, and manufacturing firms.
• Integrity: High — An attacker can modify drawing files, plant designs, or BIM models, potentially affecting physical construction or manufacturing processes (a blend of IT and OT impact).
• Availability: High — Ransomware deployment could encrypt critical design data, halting project timelines and causing revenue loss.

Affected Systems

Any system with an Autodesk product that includes a BMP parsing engine. This includes:

• Design workstations running AutoCAD / AutoCAD LT.
• BIM workstations running Revit.
• Engineering workstations running Inventor, Civil 3D, Fusion 360.
• Viewers such as Autodesk Design Review and DWG TrueView.
• Server-side rendering services, if exposed to untrusted file inputs.

Blast Radius

The user-interaction requirement (UI:R → UI:R) limits fully remote, wormable exploitation, but the impact is significant: C:H / I:H / A:H subscores confirm a full-takeover potential on any affected host. In organizations where designers hold local administrator rights, the entire workstation is compromised, and the network becomes an adjacent playground for lateral movement. A single malicious BMP traded on a shared project forum could compromise multiple firms using the same vulnerable Autodesk version.

Detection Guidance

Sigma Rule

title: Suspicious DLL Load or Injection Post BMP Open - Autodesk Products
id: 2f8eaa91-9f0e-4d0a-b3b4-0e6dcb8f617f
status: experimental
description: Detects process behavior consistent with exploitation of CVE-2026-7406 (Untrusted Pointer Dereference) in Autodesk products when opening crafted BMP files.
author: ValtersIT Threat Intelligence
date: 2026/07/05
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\acad.exe'
      - '\revit.exe'
      - '\inventor.exe'
      - '\designreview.exe'
      - '\dwfviewer.exe'
  selection_child:
    Image|endswith:
      - '\rundll32.exe'
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
    CommandLine|contains:
      - '-enc'
      - 'IEX'
      - 'DownloadString'
      - 'bitsadmin'
      - 'certutil -urlcache'
  condition: selection_parent and selection_child
  timeframe: 30s
fields:
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Legitimate automation or add-on scripts loading via these methods
level: high

YARA Rule

rule CVE_2026_7406_Malicious_BMP_Autodesk
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects crafted BMP files designed to trigger Untrusted Pointer Dereference (CWE-822) in Autodesk products"
        reference = "CVE-2026-7406"
        date = "2026-07-05"
        score = 70

    strings:
        // BMP file signature
        $bmp_magic = "BM"

        // Suspicious offset values that could be used as poisoned pointers
        $off_bits = { 0A 00 00 00 }  // valid - used as baseline
        $susp_value_1 = { 00 00 00 00 } // potential null/dangling pointer
        $susp_value_2 = { FF FF FF FF } // very large pointer value

        // Shellcode / NOP sled patterns often embedded in pixel data
        $nop_sled_int3 = { 90 90 90 90 90 90 90 90 CC CC }
        $call_ebp = { FF D5 }
        $call_esp = { FF D4 }

        // UTF-8 encoded strings typical of a payload stub
        $http_download = "http://" ascii
        $wininet = "WinHttpOpen" ascii

    condition:
        $bmp_magic at 0 and
        (
            (uint32(18) > 0xFFFFFF00 or uint32(18) == 0 or uint32(10) == 0 or uint32(10) > 0xFFFF)
            and
            (uint32(10) > (filesize - 54))
        )
        and
        (
            $nop_sled_int3 or $call_ebp or $call_esp or
            ($http_download and $wininet)
        )
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-7406 Possible Malicious BMP File Transfer - Suspicious Header Values"; flow:established,to_client; content:"|42 4D|"; depth:2; content:"|00 00 00 00|"; offset:10; depth:4; content:"|FF FF FF FF|"; offset:18; depth:4; content:"|00 00 00 00|"; offset:54; depth:4; sid:20260705; rev:1; reference:cve,CVE-2026-7406; reference:url,valtersit.com/threat-intel/CVE-2026-7406;)

Elastic Detection

process where event.action == "start" and
  process.parent.name in ("acad.exe", "revit.exe", "inventor.exe", "designreview.exe", "dwfviewer.exe") and
  (
    process.name in ("rundll32.exe", "cmd.exe", "powershell.exe", "cscript.exe", "wscript.exe") or
    process.command_line contains any of ("-enc", "IEX", "DownloadString", "bitsadmin", "certutil -urlcache")
  )

Splunk SPL Query

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where match(ParentImage, "(?i)(acad|revit|inventor|designreview|dwfviewer)\.exe$")
| where match(Image, "(?i)(rundll32|cmd|powershell|cscript|wscript)\.exe$") OR match(CommandLine, "(?i)(-enc|IEX|DownloadString|bitsadmin|certutil -urlcache)")
| table _time, User, ParentImage, ProcessImage, CommandLine, ComputerName
| sort - _time

Wazuh OSSEC Rule

<group name="sysmon,">
    <rule id="100221" level="12">
        <if_sid>61603</if_sid>
        <field name="win.eventdata.parentImage" type="pcre2">(?i)(acad|revit|inventor|designreview|dwfviewer)\.exe$</field>
        <field name="win.eventdata.image" type="pcre2">(?i)(rundll32|cmd|powershell|cscript|wscript)\.exe$</field>
        <description>Potential CVE-2026-7406 exploitation attempt: Autodesk product ({win.eventdata.parentImage}) spawned suspicious process ({win.eventdata.image})</description>
        <group>autodesk, cve-2026-7406, exploitation,</group>
    </rule>

    <rule id="100222" level="14">
        <if_sid>61603</if_sid>
        <field name="win.eventdata.parentImage" type="pcre2">(?i)(acad|revit|inventor|designreview|dwfviewer)\.exe$</field>
        <field name="win.eventdata.commandLine" type="pcre2">(?i)(-enc|IEX|DownloadString|bitsadmin|certutil -urlcache)</field>
        <description>Severe CVE-2026-7406 exploitation: Autodesk process ({win.eventdata.parentImage}) executing suspicious command line ({win.eventdata.commandLine})</description>
        <group>autodesk, cve-2026-7406, exploitation,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor advisory, no official patch, and no recommended fixed version has been identified from any tracked source. The following guidance reflects best-available defensive measures.

1. Immediate Mitigations

• Restrict file uploads: Block .bmp file uploads to web portals, email gateways, or shared project repositories where Autodesk applications might auto-parse them.
• Email filtering: At the email gateway, quarantine or block zip/rar archives containing image files (.bmp, .dib, .rle) from untrusted or external senders.
• User education: Notify design and engineering teams of this active bait — instruct them not to open BMP files from unverified sources.
• Application hardening: Use Microsoft EMET or Windows Defender Exploit Guard (if compatible) to enable Import Address Table (IAT) Access Protection and Arbitrary Code Guard on acad.exe, revit.exe, inventor.exe, and other affected modules.

2. Patch / Upgrade Steps

• Monitor vendor updates: Watch the Autodesk Security Advisory RSS feed and Autodesk Trust Center (www.autodesk.com/trust) for a service pack or hotfix referencing CVE-2026-7406.
• Test and deploy: When a patched version is released, prioritize deployment to:
  1. Design workstations with local admin rights.
  2. Any server processing untrusted file uploads (rendering services, cloud conversion tools).
• Vendor notification: If your organization has a direct Autodesk support contract, file an incident ticket referencing CVE-2026-7406 to scope the fix timeline internally.

3. Long-term Hardening

• Principle of Least Privilege: Remove local administrator rights from design workstations — this limits the post-exploitation blast radius (an attacker executing with standard user privileges cannot easily persist as SYSTEM).
• Application allowlisting: Use Microsoft AppLocker or WDAC to allow only signed Autodesk binaries and legitimate add-ons to run.
• Network segmentation: Isolate CAD/CAM workstations from general corporate IT networks; treat design data as crown jewels.
• BMP file sanitization: Implement a file sanitization gateway (e.g., using a "re-encode" tool) that converts incoming BMP files to PNG before allowing them to reach workstations.
• Regular security audits: Perform periodic forensic scans of shared drives for anomalous BMP files.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-7406
2. Autodesk Trust Center: https://www.autodesk.com/trust/security-advisories (monitor for future advisory)
3. MITRE ATT&CK Technique Reference: T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
4. CWE-822 — Untrusted Pointer Dereference: https://cwe.mitre.org/data/definitions/822.html
5. CISA Known Exploited Vulnerabilities Catalog (monitor for addition): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Known Threat Actor Campaigns / Exploit-in-the-Wild Evidence: None confirmed at the time of writing. The CVE has not been added to CISA KEV, and no public exploit code or active exploitation campaigns have been observed. Security teams should nevertheless treat this as a high-priority unpatched vulnerability given the ease of crafting a malicious BMP and the prevalence of Autodesk software in high-value engineering sectors.