How severe is CVE-2025-5039?

CVE-2025-5039 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-5039 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-5039?

CVE-2025-5039 primarily affects Autodesk Infrastructure Parts Editor. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2025-5039?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2025-5039 have an EU (EUVD) identifier?

Yes. CVE-2025-5039 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-22536.

When was CVE-2025-5039 published?

CVE-2025-5039 was published on 2025-07-24 and last updated on 2026-06-17.

CVE-2025-5039

CVE-2025-5039 is a high-severity vulnerability in Autodesk Infrastructure Parts Editor with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-426.

Key facts

Severity: High (CVSS 3.x base score 7.8)
EPSS exploit prediction: 0% (7th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-22536
Weakness: CWE-426
Affected product: Autodesk Infrastructure Parts Editor
Published: 2025-07-24
Last modified: 2026-06-17

Description

A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context of the current process due to an untrusted search path being utilized.

Frequently asked questions

What is CVE-2025-5039?: A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context of the current process due to an untrusted search path being utilized.
How severe is CVE-2025-5039?: CVE-2025-5039 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-5039 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-5039?: CVE-2025-5039 primarily affects Autodesk Infrastructure Parts Editor. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2025-5039?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2025-5039 have an EU (EUVD) identifier?: Yes. CVE-2025-5039 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-22536.
When was CVE-2025-5039 published?: CVE-2025-5039 was published on 2025-07-24 and last updated on 2026-06-17.

References

Affected products (6)

cpe:2.3:a:autodesk:infrastructure_parts_editor:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:inventor:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:navisworks_manage:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:navisworks_simulate:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:vault:*:*:*:*:*:*:*:*

More vulnerabilities in Autodesk Infrastructure Parts Editor

CVE-2025-1276 — High (CVSS 7.8): A maliciously crafted DWG file, when parsed through certain Autodesk applications, can force an Out-of-Bounds Write…
CVE-2021-40166 — High (CVSS 7.8): A maliciously crafted PNG file in Autodesk Image Processing component may be used to attempt to free an object that has…
CVE-2021-40165 — High (CVSS 7.8): A maliciously crafted TIFF, PICT, TGA, or RLC file in Autodesk Image Processing component may be used to write beyond…
CVE-2021-40164 — High (CVSS 7.8): A heap-based buffer overflow could occur while parsing TIFF, PICT, TGA, or RLC files. This vulnerability may be…
CVE-2021-40163 — High (CVSS 7.8): A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through Autodesk…
CVE-2021-40162 — High (CVSS 7.8): A maliciously crafted TIF, PICT, TGA, or RLC files in Autodesk Image Processing component may be forced to read beyond…

All CVEs affecting Autodesk Infrastructure Parts Editor →

Other CWE-426 (Untrusted Search Path) vulnerabilities

CVE-2026-45772 — Critical (CVSS 9.8): Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14,…
CVE-2025-26155 — Critical (CVSS 9.8): NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path…
CVE-2024-53866 — Critical (CVSS 9.8): The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one…
CVE-2024-38462 — Critical (CVSS 9.8): iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the…
CVE-2023-30330 — Critical (CVSS 9.8): SoftExpert (SE) Excellence Suite 2.x versions before 2.1.3 is vulnerable to Local File Inclusion in the function…
CVE-2022-24826 — Critical (CVSS 9.8): On Windows, if Git LFS operates on a malicious repository with a `..exe` file as well as a file named `git.exe`, and…

Browse all CWE-426 (Untrusted Search Path) vulnerabilities →