---
id: "CVE-2026-113775"
kind: "vulnerability"
aliases: ["CVE-2026-113775"]
title: "Autodesk Fusion: crafted DLL loaded via TextCommands.LoadDll runs code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["autodesk-fusion", "other", "windows"]
not_affected_if: []
published_at: "2026-10-27T17:16:58+00:00"
first_seen_at: "2026-10-27T17:32:45+00:00"
updated_at: "2026-10-27T17:34:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113775", "first_seen_at": "2026-10-27T17:32:45+00:00"}]
---

# Autodesk Fusion: crafted DLL loaded via TextCommands.LoadDll runs code

The Autodesk Fusion desktop application exposes a TextCommands.LoadDll command through its API that loads a dynamic library from an arbitrary path without restriction. A malicious actor who supplies a crafted library can execute arbitrary code in the context of the running Fusion process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-27T17:32:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113775

## From the sources

A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can trigger an Exposed Dangerous Function vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to execute arbitrary code in the context of the current process.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_