How severe is CVE-2023-25005?

CVE-2023-25005 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2023-25005 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (12th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-25005?

CVE-2023-25005 primarily affects Autodesk Infraworks. In total, 12 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-25005?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2023-25005 published?

CVE-2023-25005 was published on 2023-05-12 and last updated on 2026-06-17.

CVE-2023-25005

CVE-2023-25005 is a high-severity vulnerability in Autodesk Infraworks with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-427.

Key facts

Severity: High (CVSS 3.x base score 7.8)
EPSS exploit prediction: 0% (12th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-427
Affected product: Autodesk Infraworks
Published: 2023-05-12
Last modified: 2026-06-17

Description

A maliciously crafted DLL file can be forced to read beyond allocated boundaries in Autodesk InfraWorks 2023, and 2021 when parsing the DLL files could lead to a resource injection vulnerability.

Frequently asked questions

What is CVE-2023-25005?: A maliciously crafted DLL file can be forced to read beyond allocated boundaries in Autodesk InfraWorks 2023, and 2021 when parsing the DLL files could lead to a resource injection vulnerability.
How severe is CVE-2023-25005?: CVE-2023-25005 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2023-25005 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (12th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-25005?: CVE-2023-25005 primarily affects Autodesk Infraworks. In total, 12 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-25005?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2023-25005 published?: CVE-2023-25005 was published on 2023-05-12 and last updated on 2026-06-17.

References

https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0006

Affected products (12)

cpe:2.3:a:autodesk:infraworks:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:infraworks:2021.2:-:*:*:*:*:*:*
cpe:2.3:a:autodesk:infraworks:2021.2:hotfix_1:*:*:*:*:*:*
cpe:2.3:a:autodesk:infraworks:2021.2:hotfix_2:*:*:*:*:*:*
cpe:2.3:a:autodesk:infraworks:2021.2:hotfix_3:*:*:*:*:*:*
cpe:2.3:a:autodesk:infraworks:2021.2:hotfix_4:*:*:*:*:*:*
cpe:2.3:a:autodesk:infraworks:2021.2:hotfix_5:*:*:*:*:*:*
cpe:2.3:a:autodesk:infraworks:2021.2:hotfix_6:*:*:*:*:*:*
cpe:2.3:a:autodesk:infraworks:2021.2:hotfix_7:*:*:*:*:*:*
cpe:2.3:a:autodesk:infraworks:2021.2:hotfix_8:*:*:*:*:*:*
cpe:2.3:a:autodesk:infraworks:2021.2:hotfix_9:*:*:*:*:*:*
cpe:2.3:a:autodesk:infraworks:2023.1:-:*:*:*:*:*:*

More vulnerabilities in Autodesk Infraworks

CVE-2023-29068 — High (CVSS 7.8): A maliciously crafted file consumed through pskernel.dll file could lead to memory corruption vulnerabilities. These…
CVE-2023-25004 — High (CVSS 7.8): A maliciously crafted pskernel.dll file in Autodesk products is used to trigger integer overflow vulnerabilities.…
CVE-2023-25003 — High (CVSS 7.8): A maliciously crafted pskernel.dll file in Autodesk AutoCAD 2023 and Maya 2022 may be used to trigger out-of-bound read…
CVE-2021-40166 — High (CVSS 7.8): A maliciously crafted PNG file in Autodesk Image Processing component may be used to attempt to free an object that has…
CVE-2021-40165 — High (CVSS 7.8): A maliciously crafted TIFF, PICT, TGA, or RLC file in Autodesk Image Processing component may be used to write beyond…
CVE-2021-40164 — High (CVSS 7.8): A heap-based buffer overflow could occur while parsing TIFF, PICT, TGA, or RLC files. This vulnerability may be…

All CVEs affecting Autodesk Infraworks →

Other CWE-427 (Uncontrolled Search Path Element) vulnerabilities

CVE-2025-4981 — Critical (CVSS 9.9): Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to…
CVE-2025-69599 — Critical (CVSS 9.8): RayVentory Scan Engine through 12.6 Update 8 allows attackers to gain privileges if they control the value of the PATH…
CVE-2019-25268 — Critical (CVSS 9.8): NREL BEopt 2.8.0.0 contains a DLL hijacking vulnerability that allows attackers to load arbitrary libraries by tricking…
CVE-2023-53959 — Critical (CVSS 9.8): FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by…
CVE-2025-65741 — Critical (CVSS 9.8): Sublime Text 3 Build 3208 or prior for MacOS is vulnerable to Dylib Injection. An attacker could compile a .dylib file…
CVE-2024-23054 — Critical (CVSS 9.8): An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution…

Browse all CWE-427 (Uncontrolled Search Path Element) vulnerabilities →