Listen to this Post
How the CVE Works
CVE-2025-5335 exploits an untrusted search path vulnerability in the Autodesk Installer application. When a malicious binary is downloaded and executed, the installer improperly searches for dependencies in directories controlled by an attacker. By placing a malicious DLL in a directory with higher search precedence, an attacker can escalate privileges to NT AUTHORITY/SYSTEM, leading to arbitrary code execution. The flaw stems from insecure DLL loading mechanisms, allowing attackers to hijack the execution flow.
DailyCVE Form
Platform: Autodesk Installer
Version: Multiple versions
Vulnerability: Untrusted search path
Severity: Critical
Date: 06/10/2025
Prediction: Patch expected by 08/15/2025
What Undercode Say
Check for vulnerable Autodesk Installer versions wmic product where "name like 'Autodesk%'" get version Detect malicious DLL hijacking procmon.exe /accepteula /noconnect /backingfile log.pml /quiet
How Exploit
- Craft malicious DLL matching expected dependency.
- Place DLL in writable directory with higher search priority.
- Trigger installer to load malicious payload.
Protection from this CVE
- Apply vendor patch immediately.
- Restrict installer directory permissions.
- Use Microsoft Attack Surface Reduction (ASR) rules.
Impact
- Full system compromise (NT AUTHORITY/SYSTEM).
- Remote code execution possible.
- Exploitable via phishing or malicious downloads.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
