CVE-2026-14255— IFC File Parsing Uncontrolled Recursion in Certain Autodesk Products
Quick assessment
Affected
Autodesk Shared Components
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
一个恶意构造的 IFC 文件，当通过某些 Autodesk 产品进行解析时，可能触发“不可控递归”（Uncontrolled Recursion）漏洞。攻击者可利用该漏洞导致应用程序意外终止，从而引发拒绝服务（DoS）。利用此漏洞需要用户打开一个特制的 IFC 文件。
Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Autodesk | Shared Components | 1.11.0< 1.12.0 |
affected |
2.0.0< 2.2.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-14255
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
IFC File Parsing Uncontrolled Recursion in Certain Autodesk Products
Source: CVE Program / CVE List V5
Vulnerability Description
A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to cause the application to terminate unexpectedly, resulting in a denial-of-service. Exploitation requires a user to open a specially crafted IFC file.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的递归
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Autodesk | Shared Components | 1.11.0 ~ 1.12.0 |
cpe:2.3:a:autodesk:shared_components:1.11.0.3:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-14255
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14255
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14255 (1)
-
🔗 404 vendor-advisory
IV. Related Vulnerabilities
Same product: Shared Components
-
CVE-2026-0875
MODEL File Parsing Out-of-Bounds Write -
CVE-2026-0874
CATPART File Parsing Out-of-Bounds Write -
CVE-2025-10900
MODEL File Parsing Out-of-Bounds Write Vulnerability -
CVE-2025-10899
MODEL File Parsing Out-of-Bounds Write Vulnerability -
CVE-2025-10898
MODEL File Parsing Out-of-Bounds Write Vulnerability
Same vendor: Autodesk
-
CVE-2026-19568
SVG File Parsing Memory Corruption Vulnerability in Autodesk -
CVE-2026-7455
FLT File Parsing Out-of-Bounds Write Vulnerability in Autode -
CVE-2026-16783
ABC File Parsing Out-of-Bounds Write Vulnerability in Autode -
CVE-2026-16782
SVG File Parsing Out-of-Bounds Read Vulnerability in Autodes -
CVE-2026-16781
SVG File Parsing Stack Exhaustion Vulnerability in Autodesk
Same weakness: CWE-674
-
CVE-2026-84851
Uncontrolled recursion in the Ion reader in Amazon Ion-C bef -
CVE-2026-81928
Net::DNS versions before 1.57 for Perl allow memory exhausti -
CVE-2026-82797
SAMSUNG rlottie 资源管理错误漏洞 -
CVE-2026-82604
BareBones BBEdit Java Language recursion -
CVE-2026-78228
Unbounded handle_error recursion enables denial of service i
V. Comments for CVE-2026-14255
No comments yet