Autodesk 3ds Max CVE-2026-0537
HIGHSeverity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A maliciously crafted RGB file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
AnalysisAI
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted RGB image file, triggering an out-of-bounds write (CWE-787) that corrupts memory in the running process. Exploitation requires a victim to open the malicious file locally, but no public exploit has been identified at time of analysis and EPSS rates real-world exploitation likelihood at just 0.01%. The flaw was reported by Autodesk PSIRT and is tracked under advisory ADSK-SA-2026-0002.
Technical ContextAI
The vulnerability resides in the RGB (SGI/Silicon Graphics Image) file format parser within Autodesk 3ds Max, identified in CPE data as cpe:2.3:a:autodesk:3ds_max. RGB is a legacy raster image format historically supported by 3D content pipelines, and parsing it involves decoding run-length-encoded scanlines and channel data into memory buffers. The root cause is classified as CWE-787 (Out-of-Bounds Write), meaning the parser writes attacker-controlled data past the bounds of an allocated buffer - typically because length or offset fields inside the malformed RGB file are not validated before being used to index or copy into memory, leading to memory corruption that can be steered into control-flow hijack.
RemediationAI
Patch available per vendor advisory ADSK-SA-2026-0002 at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0002 - apply the fixed 3ds Max build distributed via Autodesk Access (https://www.autodesk.com/products/autodesk-access/overview); exact fix version is not enumerated in the provided intelligence and should be taken from the advisory. Until patching, restrict 3ds Max users from opening RGB files received from untrusted sources (email, downloads, shared asset drops), enforce inbound file scanning or block the .rgb/.sgi extensions at email and file-sharing gateways, and consider running 3ds Max under a least-privilege Windows account so that arbitrary code execution does not inherit administrative rights; the trade-off of extension blocking is that legitimate legacy RGB assets in production pipelines will need to be converted (e.g., to PNG or EXR) by a trusted workstation before use.
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted GIF file, triggeri
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted RGB image file, re
Stack-based buffer overflow in Autodesk 3ds Max enables arbitrary code execution when the application parses a malicious
Out-of-bounds read in Autodesk 3ds Max's SVG file parser enables crash, sensitive memory disclosure, or arbitrary code e
Out-of-bounds write in Autodesk 3ds Max's FLT file parser allows an attacker to cause a crash, corrupt data, or execute
Memory corruption via maliciously crafted SVG files in Autodesk 3ds Max allows arbitrary code execution within the curre
Out-of-bounds write in Autodesk 3ds Max's Alembic (ABC) file parser enables arbitrary code execution in the context of t
Arbitrary code execution in Autodesk 3ds Max 2026 and 2027 occurs when the application parses a maliciously crafted WRL
Arbitrary code execution in Autodesk 3ds Max occurs when users open max files from maliciously crafted project directori
Arbitrary code execution in Autodesk 3ds Max 2026 (<2026.1) and 2027 (<2027.1) is possible when a user opens a malicious
Out-of-bounds write in Autodesk 3ds Max 2026 and 2027 enables arbitrary code execution when a user opens a maliciously c
Autodesk 3ds Max is vulnerable to arbitrary code execution when processing maliciously crafted GIF files due to a stack-
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today