PatchTheCVECVE-2025-5039: A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could le
30
Routine
HIGH 7.8UPGRADEUPGRADEUPGRADE
CVE-2025-5039 is a high-severity flaw (CVSS 7.8) affecting infrastructure parts editor, inventor, navisworks manage. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context of the current process due to an untrusted search path being utilized.
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.8 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 89%) |
| CISA exploited list | No |
| Weakness | CWE-426 |
| Published | 2025-07-24 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
autodesk infrastructure parts editor UPGRADE
Affected: >= 2026 and < 2026.0.2
Fixed in: 2026.0.2
Safe to downgrade to: a release before 2026
1. Check installed version
apt-cache policy infrastructure-parts-editor || rpm -q infrastructure-parts-editor || infrastructure-parts-editor --version
2. UPGRADE to 2026.0.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade infrastructure-parts-editor
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade infrastructure-parts-editor
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 2026 (Debian / Ubuntu)
apt-cache madison infrastructure-parts-editor
sudo apt install infrastructure-parts-editor=<VERSION_BEFORE_2026>
sudo apt-mark hold infrastructure-parts-editor
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list infrastructure-parts-editor
sudo dnf downgrade infrastructure-parts-editor-<VERSION_BEFORE_2026>
sudo dnf versionlock add infrastructure-parts-editor
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
autodesk inventor UPGRADE
Affected: >= 2026 and < 2026.0.2
Fixed in: 2026.0.2
Safe to downgrade to: a release before 2026
1. Check installed version
apt-cache policy inventor || rpm -q inventor || inventor --version
2. UPGRADE to 2026.0.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade inventor
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade inventor
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 2026 (Debian / Ubuntu)
apt-cache madison inventor
sudo apt install inventor=<VERSION_BEFORE_2026>
sudo apt-mark hold inventor
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list inventor
sudo dnf downgrade inventor-<VERSION_BEFORE_2026>
sudo dnf versionlock add inventor
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
autodesk navisworks manage UPGRADE
Affected: >= 2026 and < 2026.0.2
Fixed in: 2026.0.2
Safe to downgrade to: a release before 2026
1. Check installed version
apt-cache policy navisworks-manage || rpm -q navisworks-manage || navisworks-manage --version
2. UPGRADE to 2026.0.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade navisworks-manage
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade navisworks-manage
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 2026 (Debian / Ubuntu)
apt-cache madison navisworks-manage
sudo apt install navisworks-manage=<VERSION_BEFORE_2026>
sudo apt-mark hold navisworks-manage
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list navisworks-manage
sudo dnf downgrade navisworks-manage-<VERSION_BEFORE_2026>
sudo dnf versionlock add navisworks-manage
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
autodesk navisworks simulate UPGRADE
Affected: >= 2026 and < 2026.0.2
Fixed in: 2026.0.2
Safe to downgrade to: a release before 2026
1. Check installed version
apt-cache policy navisworks-simulate || rpm -q navisworks-simulate || navisworks-simulate --version
2. UPGRADE to 2026.0.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade navisworks-simulate
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade navisworks-simulate
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 2026 (Debian / Ubuntu)
apt-cache madison navisworks-simulate
sudo apt install navisworks-simulate=<VERSION_BEFORE_2026>
sudo apt-mark hold navisworks-simulate
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list navisworks-simulate
sudo dnf downgrade navisworks-simulate-<VERSION_BEFORE_2026>
sudo dnf versionlock add navisworks-simulate
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
autodesk revit UPGRADE
Affected: >= 2026 and < 2026.0.2
Fixed in: 2026.0.2
Safe to downgrade to: a release before 2026
1. Check installed version
apt-cache policy revit || rpm -q revit || revit --version
2. UPGRADE to 2026.0.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade revit
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade revit
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 2026 (Debian / Ubuntu)
apt-cache madison revit
sudo apt install revit=<VERSION_BEFORE_2026>
sudo apt-mark hold revit
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list revit
sudo dnf downgrade revit-<VERSION_BEFORE_2026>
sudo dnf versionlock add revit
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
autodesk vault UPGRADE
Affected: >= 2026 and < 2026.0.2
Fixed in: 2026.0.2
Safe to downgrade to: a release before 2026
1. Check installed version
apt-cache policy vault || rpm -q vault || vault --version
2. UPGRADE to 2026.0.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade vault
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade vault
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 2026 (Debian / Ubuntu)
apt-cache madison vault
sudo apt install vault=<VERSION_BEFORE_2026>
sudo apt-mark hold vault
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list vault
sudo dnf downgrade vault-<VERSION_BEFORE_2026>
sudo dnf versionlock add vault
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-5039?
infrastructure parts editor: upgrade to 2026.0.2; inventor: upgrade to 2026.0.2; navisworks manage: upgrade to 2026.0.2. Exact commands for each OS are on this page.
Is CVE-2025-5039 being exploited?
CVE-2025-5039 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-5039 affect?
CVE-2025-5039 affects infrastructure parts editor, inventor, navisworks manage. Severity is high (CVSS 7.8). A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context of the current process due to an untrusted search path being utilized.
How urgent is CVE-2025-5039?
Priority 30/100. High severity
Software pages
HashiCorp Vault vulnerabilities