What is the CVSS score of CVE-2026-0537?

CVE-2026-0537 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Autodesk 3ds Max are affected by CVE-2026-0537?

Autodesk 3ds Max contains a high-severity code execution vulnerability (CVE-2026-0537) triggered by opening maliciously crafted RGB image files, affecting design and engineering teams.

How to fix or mitigate CVE-2026-0537?

Within 24 hours: Inventory all Autodesk 3ds Max installations and restrict file-sharing from untrusted external sources. Within 7 days: Issue user awareness messaging about RGB image file risks and implement application sandboxing or whitelisting if feasible. Within 30 days: Monitor Autodesk PSIRT advisory ADSK-SA-2026-0002 continuously for patch release and establish testing plan for immediate deployment.

Autodesk 3ds Max CVE-2026-0537

HIGH

Out-of-bounds Write (CWE-787)

2026-02-04 psirt@autodesk.com

Memory Corruption Buffer Overflow RCE 3ds Max

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 03, 2026 - 14:35 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 03, 2026 - 14:34 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 03, 2026 - 14:22 vuln.today

cvss_changed

CVSS changed

Jun 03, 2026 - 14:22 NVD

7.8 (HIGH) 8.4 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 04, 2026 - 17:16 nvd

HIGH 7.8

DescriptionCVE.org

A maliciously crafted RGB file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

AnalysisAI

Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted RGB image file, triggering an out-of-bounds write (CWE-787) that corrupts memory in the running process. Exploitation requires a victim to open the malicious file locally, but no public exploit has been identified at time of analysis and EPSS rates real-world exploitation likelihood at just 0.01%. The flaw was reported by Autodesk PSIRT and is tracked under advisory ADSK-SA-2026-0002.

Technical ContextAI

The vulnerability resides in the RGB (SGI/Silicon Graphics Image) file format parser within Autodesk 3ds Max, identified in CPE data as cpe:2.3:a:autodesk:3ds_max. RGB is a legacy raster image format historically supported by 3D content pipelines, and parsing it involves decoding run-length-encoded scanlines and channel data into memory buffers. The root cause is classified as CWE-787 (Out-of-Bounds Write), meaning the parser writes attacker-controlled data past the bounds of an allocated buffer - typically because length or offset fields inside the malformed RGB file are not validated before being used to index or copy into memory, leading to memory corruption that can be steered into control-flow hijack.

RemediationAI

Patch available per vendor advisory ADSK-SA-2026-0002 at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0002 - apply the fixed 3ds Max build distributed via Autodesk Access (https://www.autodesk.com/products/autodesk-access/overview); exact fix version is not enumerated in the provided intelligence and should be taken from the advisory. Until patching, restrict 3ds Max users from opening RGB files received from untrusted sources (email, downloads, shared asset drops), enforce inbound file scanning or block the .rgb/.sgi extensions at email and file-sharing gateways, and consider running 3ds Max under a least-privilege Windows account so that arbitrary code execution does not inherit administrative rights; the trade-off of extension blocking is that legitimate legacy RGB assets in production pipelines will need to be converted (e.g., to PNG or EXR) by a trusted workstation before use.