CVE-2026-14255
Medium
Description
A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to cause the application to terminate unexpectedly, resulting in a denial-of-service. Exploitation requires a user to open a specially crafted IFC file.
SeverityMedium
CVSS5.5
Exploit probability5. percentile0.2%
Product
Autodesk Shared Components
PublishedSep 2, 2026
First seenSep 2, 2026
Weakness typeCWE-674CWE-674
How to fix
Update
- autodesk shared_components1.12.0, 2.2.0 or later
- autodesk revit2027.3.0, 2026.5.1, 2025.5.0 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| autodesk shared_components | 1.11.0 ≤ v < 1.12.0, 2.0.0 ≤ v < 2.2.0 | 1.12.0, 2.2.0 |
| autodesk revit | 2027.0.0 ≤ v < 2027.3.0, 2026.0.0 ≤ v < 2026.5.1, 2025.0.0 ≤ v < 2025.5.0 | 2027.3.0, 2026.5.1, 2025.5.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.