What is the CVSS score of CVE-2026-0536?

CVE-2026-0536 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of 3ds Max are affected by CVE-2026-0536?

A critical vulnerability in Autodesk 3ds Max allows attackers to execute arbitrary code by sending malicious GIF files to users.

How to fix or mitigate CVE-2026-0536?

Within 24 hours: Identify all systems running Autodesk 3ds Max and restrict user access to untrusted GIF files; disable GIF import if not business-critical. Within 7 days: Implement network segmentation to isolate 3ds Max workstations and monitor for suspicious file activity. Within 30 days: Subscribe to Autodesk security advisories for patch availability and establish a patch deployment plan; consider alternative file formats or air-gapped workflows for high-risk users.

3ds Max CVE-2026-0536

HIGH

Out-of-bounds Write (CWE-787)

2026-02-04 psirt@autodesk.com

Buffer Overflow Stack Overflow 3ds Max

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 04, 2026 - 19:16 nvd

HIGH 7.8

DescriptionCVE.org

A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can cause a Stack-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

AnalysisAI

Autodesk 3ds Max is vulnerable to arbitrary code execution when processing maliciously crafted GIF files due to a stack-based buffer overflow (CVE-2026-0536, CVSS 7.8). Local attackers can exploit this vulnerability by tricking users into opening a malicious GIF file to execute code with the privileges of the 3ds Max process. No patch is currently available.

Technical ContextAI

Classified as CWE-787 (Out-of-bounds Write). Affects 3Ds Max. A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can cause a Stack-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.