CVE-2026-1288: Autodesk Revit RFA-to-FormIt Null Pointer Dereference Denial of Service

Technical summary

CVE-2026-1288 is a NULL Pointer Dereference vulnerability (CWE-476) in Autodesk Revit's RFA-to-FormIt conversion routine. When a maliciously crafted RFA file is processed, the converter fails to validate or properly handle a critical pointer, resulting in a null dereference that crashes the application. The vulnerability has a CVSS 3.1 score of 5.5 (Medium severity) with a local attack vector, low complexity, no privilege requirement, and user interaction needed. The impact is availability only—no confidentiality or integrity compromise.

Business impact

This vulnerability causes unplanned downtime for Revit users who encounter a malicious RFA file. While the impact is limited to application crashes rather than data loss or theft, interrupted workflows can delay design projects, especially in multi-user environments where shared file libraries may contain a compromised RFA. Organizations relying on Revit for critical design work face productivity disruption, but the risk is containable through file vetting and user awareness.

Affected systems

Autodesk Revit is the affected product. The vulnerability is triggered specifically during the "Convert RFA to FormIt" operation, so it affects only users who use this conversion feature. Organizations not using FormIt conversion are not exposed to this particular attack path. The vulnerability requires a local attack vector, meaning the malicious RFA file must be present on or accessible to the target system.

Exploitability

The vulnerability is straightforward to exploit in principle—crafting a malicious RFA file—but the attack requires user interaction and local access. An attacker would need to distribute the malicious file (via email, shared repository, or file-sharing service) and convince a user to open it in Revit and trigger the conversion. It is not remotely exploitable and does not escalate privileges. The barrier to exploitation is moderate: technical skill is needed to craft the RFA, and social engineering or insider access increases likelihood. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Users should immediately apply any security patch or update released by Autodesk for Revit that addresses this null pointer dereference. Pending a patch, organizations should restrict the use of the RFA-to-FormIt conversion feature or implement file controls to prevent untrusted RFA files from reaching users. Users should be cautious when opening RFA files from untrusted sources and should validate files through trusted channels before conversion.

Patch guidance

Check Autodesk's official security advisories and Revit release notes for patched versions. Patches should be tested in a non-production environment before enterprise rollout to ensure compatibility with custom plugins or workflows. If FormIt conversion is not essential to your workflow, disabling or restricting access to this feature can serve as a temporary mitigation. Verify patch applicability to your specific Revit version and operating system.

Detection guidance

Monitor for unexpected Revit application crashes, particularly when users are converting RFA files to FormIt. Log application errors and check for null pointer exceptions in Revit's event viewer or application logs. If FormIt conversion is not a standard workflow in your organization, audit for any such activity. Network controls can flag downloads of RFA files from suspicious sources. Endpoint detection and response (EDR) tools should alert on repeated or suspicious Revit crashes.

Why prioritize this

This vulnerability merits prompt but not emergency remediation. The CVSS score of 5.5 reflects the local and user-interaction requirements, which reduce exploit likelihood in a well-managed environment. However, the denial-of-service impact is real, and the simplicity of crafting a malicious RFA means motivated threat actors could use it to disrupt critical design projects. Organizations with Revit as a core business tool, or those with users who frequently convert RFA files, should patch sooner. Those with limited FormIt usage can defer slightly while coordinating a broader update cycle.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a medium-severity vulnerability with availability impact only. The local attack vector (AV:L) and requirement for user interaction (UI:R) constrain the attack surface compared to remote exploits. Low complexity (AC:L) means an attacker does not need to overcome authentication or special conditions. No privilege escalation or data exposure elevates the score further. The score is appropriate for a denial-of-service condition that requires user action to trigger.

Frequently asked questions