Autodesk Installer up to 2.14 Binary File untrusted search path
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 7.2 | $0-$5k | 0.00 |
Summary
A vulnerability identified as problematic has been detected in Autodesk Installer up to 2.14. Affected by this issue is some unknown functionality of the component Binary File Handler. The manipulation leads to untrusted search path. This vulnerability is listed as CVE-2025-5335. The attack must be carried out locally. There is no available exploit. You should upgrade the affected component.
Details
A vulnerability was found in Autodesk Installer up to 2.14 and classified as critical. This issue affects some unknown functionality of the component Binary File Handler. The manipulation with an unknown input leads to a untrusted search path vulnerability. Using CWE to declare the problem leads to CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. Impacted is confidentiality, integrity, and availability. The summary by CVE is:
A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized in the Autodesk Installer application. Exploitation of this vulnerability may lead to code execution.
The advisory is shared at autodesk.com. The identification of this vulnerability is CVE-2025-5335 since 05/29/2025. The exploitation is known to be difficult. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1574 for this issue.
Upgrading to version 2.15 eliminates this vulnerability.
The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-17690). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Product
Vendor
Name
Version
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 7.4VulDB Meta Temp Score: 7.2
VulDB Base Score: 7.0
VulDB Temp Score: 6.7
VulDB Vector: 🔍
VulDB Reliability: 🔍
CNA Base Score: 7.8
CNA Vector (autodesk): 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: Untrusted search pathCWE: CWE-426
CAPEC: 🔍
ATT&CK: 🔍
Physical: Partially
Local: Yes
Remote: Partially
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: Installer 2.15
Timeline
05/29/2025 🔍06/10/2025 🔍
06/10/2025 🔍
07/29/2025 🔍
Sources
Advisory: autodesk.comStatus: Confirmed
CVE: CVE-2025-5335 (🔍)
GCVE (CVE): GCVE-0-2025-5335
GCVE (VulDB): GCVE-100-311873
EUVD: 🔍
Entry
Created: 06/10/2025 17:32Updated: 07/29/2025 21:16
Changes: 06/10/2025 17:32 (64), 06/12/2025 13:29 (1), 07/29/2025 21:16 (1)
Complete: 🔍
Cache ID: 216::103
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
No comments yet. Languages: en.
Please log in to comment.