CVE-2026-113775
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Autodesk Fusion contains an Exposed Dangerous Function vulnerability via the TextCommands.LoadDll API command. A maliciously crafted dynamic library loaded from an arbitrary path can execute arbitrary code in the context of the current process.
Risk Assessment
An attacker could exploit this to execute arbitrary code, potentially compromising the application and system. The risk requires delivering a malicious DLL.
Recommendation
Update Autodesk Fusion to a version containing the fix or restrict loading DLLs from untrusted paths. Also apply the principle of least privilege.
Other vulnerabilities in Autodesk Fusion
See all- CVE-2026-102638High
A maliciously crafted HTML payload in the description of an electronic library (.lbr) file, when displayed in the Library Manager after the library is imported, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
- CVE-2026-102637High
A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
- CVE-2026-102636High
A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
- CVE-2025-10244High
A maliciously crafted HTML payload, when rendered by the Autodesk Fusion desktop application, can trigger a Stored Cross-site Scripting (XSS) vulnerability. A malicious actor may leverage this to read local files or execute arbitrary code in the context of the current process.
Original NVD description (English source)
A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can trigger an Exposed Dangerous Function vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to execute arbitrary code in the context of the current process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS