CVE-2026-1288: CWE-476 NULL Pointer Dereference in Autodesk Revit – Live Threat Intelligence – Threat Radar

This vulnerability (CVE-2026-1288) in Autodesk Revit arises when a specially crafted RFA file is converted to FormIt using the ‘Convert RFA to FormIt’ feature. The flaw is a NULL Pointer Dereference (CWE-476) that leads to application crashes, causing denial of service. The CVSS 3.1 base score is 5.5 (medium severity), with attack vector local, low complexity, no privileges required, user interaction required, and impact limited to availability. Affected versions explicitly include 2024.0.0, 2025.0.0, 2026.0.0, and 2027.0.0. There is no vendor advisory or patch information available at this time.