Autodesk 3ds Max
CVE-2026-0538
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious GIF with malformed structure
-
DeliveryDeliver to artist via email or shared asset drive
-
ExploitVictim opens or imports file in 3ds Max
-
ExecutionGIF parser performs out-of-bounds write
-
PersistHijack execution flow in 3ds Max process
-
ImpactExecute arbitrary code as the user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a user running Autodesk 3ds Max to open or import an attacker-supplied GIF file locally - the AV:L vector confirms exploitation happens on the host, not over the network, so the attacker must deliver the file (email attachment, shared project drive, asset marketplace download) and the victim must process it in 3ds Max. PR:N means no prior authentication to 3ds Max is needed, but exploitation is gated by the human action of loading the malicious GIF and by the victim running a vulnerable, unpatched 3ds Max build on Windows; servers or render farms that never open ad-hoc image files are not realistic targets. |
| Impact | The CVSS vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.4 because impact is full triad compromise, yet the attack vector is Local - the attacker needs the victim to open the malicious GIF in 3ds Max rather than reach the host over the network. UI:N in the vector conflicts with the description's 'when parsed through 3ds Max' wording, which in practice requires a user to import or open the file; this is a known scoring quirk for file-parsing CVEs and defenders should treat exploitation as user-interaction-dependent. EPSS is very low (0.03%, 9th percentile) and the CVE is not on the CISA KEV list, consistent with a desktop-application memory corruption bug that is unlikely to see mass exploitation but is well-suited to targeted spear-phishing against studios handling untrusted assets. |
| Exploit ScenarioDerived | An attacker emails or shares via a project portal a reference image or texture pack containing a malicious GIF and convinces a 3ds Max user to open or import it; the GIF parser writes past its buffer and the attacker gains code execution as the artist, with access to their project files, network shares, and any credentials cached on the workstation. No public exploit is identified at time of analysis, so this scenario is currently theoretical based on the CWE-787 primitive. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 03, 2026
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted GIF file, triggering an out-of-bounds write (CWE-787) in its image-handling code. The flaw lets an attacker run code in the context of the user running 3ds Max; no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.03%.
Earlier versions of this analysis (2)
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted GIF file, triggering an out-of-bounds write (CWE-787) that runs attacker-controlled code in the context of the current user process. No public exploit identified at time of analysis, and EPSS remains very low (0.03%, 9th percentile), but the high CVSS (8.4) reflects full confidentiality, integrity, and availability impact once a victim opens the file.
A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. [CVSS 7.8 HIGH]
RemediationAI
Patch available per vendor advisory - apply the fixed 3ds Max build distributed through Autodesk Access as described in ADSK-SA-2026-0002 (https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0002); confirm the exact patched version against the advisory because it is not enumerated in the NVD data. Until patching is complete, instruct artists and pipeline engineers not to open GIF files from untrusted sources or shared download folders inside 3ds Max, sanitize or convert externally-sourced texture/reference assets through an image-processing tool that re-encodes GIFs (which removes attacker-controlled byte patterns at the cost of a small preprocessing step in the asset pipeline), and consider running 3ds Max under a standard user account so that any successful exploitation is constrained to that user's context rather than administrative privileges.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Autodesk 3ds Max is a Windows-based 3D modeling, animation, and rendering suite widely used in VFX, game development, and architectural visualization. The CPE cpe:2.3:a:autodesk:3ds_max:*:*:*:*:*:*:*:* indicates the entire product line is in scope pending vendor version clarification. The root cause is CWE-787 (Out-of-Bounds Write) inside the GIF parser - likely a miscalculation of buffer length when decoding LZW-compressed frames, color tables, or extension blocks - which corrupts adjacent heap or stack memory and, when shaped carefully, allows control of execution flow to achieve arbitrary code execution.
Know when 3ds Max gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Executive ViewAI
Autodesk 3ds Max contains a high-severity vulnerability that could enable attackers to execute arbitrary code on systems using the application, affecting organizations that rely on 3ds Max for design, animation, or visualization work. No vendor patch is currently available, requiring immediate implementation of user awareness and file-handling controls. Current threat level remains moderate, with no public exploit identified and minimal real-world exploitation indicators at this time.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) Restrict GIF file imports to verified, trusted sources only; (2) Conduct user education on file-handling risks and social engineering; (3) Monitor 3ds Max process execution for anomalous behavior; (4) Evaluate disabling GIF import if not required for operations; (5) Implement file source validation and quarantine procedures for external files.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted RGB image file, re
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted RGB image file, tr
Stack-based buffer overflow in Autodesk 3ds Max enables arbitrary code execution when the application parses a malicious
Out-of-bounds read in Autodesk 3ds Max's SVG file parser enables crash, sensitive memory disclosure, or arbitrary code e
Out-of-bounds write in Autodesk 3ds Max's FLT file parser allows an attacker to cause a crash, corrupt data, or execute
Memory corruption via maliciously crafted SVG files in Autodesk 3ds Max allows arbitrary code execution within the curre
Out-of-bounds write in Autodesk 3ds Max's Alembic (ABC) file parser enables arbitrary code execution in the context of t
A maliciously crafted DWG file, when parsed through Autodesk 3ds Max, can force a Use-After-Free vulnerability. Rated hi
A maliciously crafted JPG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. Ra
Arbitrary code execution in Autodesk 3ds Max 2026 and 2027 occurs when the application parses a maliciously crafted WRL
Arbitrary code execution in Autodesk 3ds Max occurs when users open max files from maliciously crafted project directori
Arbitrary code execution in Autodesk 3ds Max 2026 (<2026.1) and 2027 (<2027.1) is possible when a user opens a malicious
GitHub PoC
Exploit-DB