An attacker may convince a victim to open a malicious action micro (.actm) file that has serialized data, which may trigger a code executio…

published 2019-04-09 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-16903

cvss: 7.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.4%; EPSS 1.4% chance of exploitation in 30 days, percentile 71%
public exploits: 0; none known

An attacker may convince a victim to open a malicious action micro (.actm) file that has serialized data, which may trigger a code execution in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018, Autodesk AutoCAD P&ID 2018, Autodesk AutoCAD Plant 3D 2018, Autodesk AutoCAD LT 2018, and Autodesk Civil 3D 2018.

Exploit prediction

1.36% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.8	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

Autodesk Autodesk Civil 3D
Autodesk Autodesk Advance Steel
Autodesk Autodesk AutoCAD
Autodesk Autodesk AutoCAD Architecture
Autodesk Autodesk AutoCAD Electrical
Autodesk Autodesk AutoCAD Map 3D
Autodesk Autodesk AutoCAD Mechanical
Autodesk Autodesk AutoCAD MEP
Autodesk Autodesk AutoCAD P&ID
Autodesk Autodesk AutoCAD Plant 3D
Autodesk Autodesk AutoCAD LT

Classification

Weakness

CWE-502 Deserialization of Untrusted Data

References

autodesk.com /trust/security-advisories/adsk-sa-2019-0001
vendor-advisory

Sources

CVE List CVE-2019-7361
NVD CVE-2019-7361

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary