CVE-2026-1288— RFA File Parsing Vulnerability in Autodesk Revit
Quick assessment
Affected
Autodesk Revit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Autodesk revit是美国Autodesk公司的一款建筑信息建模软件。 autodesk revit 2027.1.0之前版本、2026.4.1之前版本、2025.4.5之前版本和2024.3.5之前版本存在异常处理不当漏洞，该漏洞源于特制RFA文件在被转换为FormIt时存在空指针取消引用，可能导致应用程序崩溃，从而造成拒绝服务攻击。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-1288
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RFA File Parsing Vulnerability in Autodesk Revit
Source: CVE Program / CVE List V5
Vulnerability Description
A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5
Vulnerability Title
autodesk revit 异常处理不当漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Autodesk revit是美国Autodesk公司的一款建筑信息建模软件。 autodesk revit 2027.1.0之前版本、2026.4.1之前版本、2025.4.5之前版本和2024.3.5之前版本存在异常处理不当漏洞，该漏洞源于特制RFA文件在被转换为FormIt时存在空指针取消引用，可能导致应用程序崩溃，从而造成拒绝服务攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-1288
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-1288
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-1288 (1)
-
🔗 Security Advisories | Autodesk | adsk-sa-2026-0007 vendor-advisory
IV. Related Vulnerabilities
Same product: Revit
-
CVE-2026-7406
BMP File Parsing Untrusted Pointer Dereference in certain Au -
CVE-2026-7405
TIF File Parsing Out-of-Bounds Read in certain Autodesk prod -
CVE-2026-11803
PDF File Parsing Out-of-Bounds Read Vulnerability in in Cert -
CVE-2026-8325
PDF File Parsing Out-of-Bounds Write Vulnerability in Certai -
CVE-2026-1289
PDF File Parsing Vulnerabilities in Certain Autodesk Desktop
Same vendor: Autodesk
-
CVE-2026-85217
Man-in-the-Middle (MITM) Vulnerability in Autodesk Fusion De -
CVE-2026-14255
IFC File Parsing Uncontrolled Recursion in Certain Autodesk -
CVE-2026-19568
SVG File Parsing Memory Corruption Vulnerability in Autodesk -
CVE-2026-7455
FLT File Parsing Out-of-Bounds Write Vulnerability in Autode -
CVE-2026-16783
ABC File Parsing Out-of-Bounds Write Vulnerability in Autode
Same weakness: CWE-476
-
CVE-2026-66859
Apache Thrift: c_glib multiplexed processor crashes on a mes -
CVE-2026-87117
Apache Thrift: PHP `thrift_protocol` accelerator dereference -
CVE-2026-82357
RT-Labs AB C-Open CANopen NULL pointer dereference -
CVE-2026-9032
Unauthenticated Onboarding Connect NULL Pointer Dereference -
CVE-2026-63686
Apache HTTP Server: mod_xml2enc crash on charset conversion
V. Comments for CVE-2026-1288
No comments yet