Autodesk Installer vulnerabilities

6 CVEs affecting Autodesk Installer, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-14479, published 2026-08-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-27908, published 2023-06-23. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A maliciously crafted DLL file can be forced to write beyond allocated boundaries in the Autodesk installer when parsing the DLL files and could lead to a Privilege Escalation vulnerability.
CVE-2025-5335, published 2025-06-10. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized in the Autodesk Installer application.…
CVE-2024-9500, published 2024-11-15. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A maliciously crafted DLL file when placed in temporary files and folders that are leveraged by the Autodesk Installer could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to insecure…
CVE-2025-10885, published 2025-11-06. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A maliciously crafted file, when executed on the victim's machine, can lead to privilege escalation to NT AUTHORITY/SYSTEM due to an insufficient validation of loaded binaries. An attacker with local…
CVE-2026-14479, published 2026-08-12. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range…
CVE-2026-14478, published 2026-08-12. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated IPC messages into named pipes, modify pipe permissions or…