What is the CVSS score of CVE-2026-0661?

CVE-2026-0661 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Autodesk 3ds Max are affected by CVE-2026-0661?

Autodesk 3ds Max contains a high-severity vulnerability (CVE-2026-0661, CVSS 8.4) that allows arbitrary code execution when users open maliciously crafted RGB image files, affecting any employee…

How to fix or mitigate CVE-2026-0661?

24 hours: Issue security alert to 3ds Max users advising against opening RGB files from untrusted sources, and inventory all installations. 7 days: Implement file access controls preventing opening of RGB files from untrusted sources (removable media, downloads, external suppliers), restrict 3ds Max access to authorized users only, and enable endpoint monitoring for suspicious process execution. 30 days: Monitor Autodesk security advisories for patch release, evaluate application sandboxing or process isolation technologies, and establish vendor update workflow for immediate patch deployment once available.

Autodesk 3ds Max CVE-2026-0661

HIGH

Out-of-bounds Write (CWE-787)

2026-02-04 psirt@autodesk.com

Memory Corruption Buffer Overflow RCE 3ds Max

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 03, 2026 - 14:31 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 03, 2026 - 14:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 03, 2026 - 14:22 vuln.today

cvss_changed

CVSS changed

Jun 03, 2026 - 14:22 NVD

7.8 (HIGH) 8.4 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 04, 2026 - 17:16 nvd

HIGH 7.8

DescriptionCVE.org

A maliciously crafted RGB file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

AnalysisAI

Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted RGB image file, resulting in a CWE-787 out-of-bounds write that corrupts memory and lets an attacker run code in the context of the user running 3ds Max. No public exploit identified at time of analysis, and the EPSS probability is only 0.01%, but the CVSS base score of 8.4 reflects the high impact when a victim is convinced to open a weaponized asset file.

Technical ContextAI

Autodesk 3ds Max is a Windows-based 3D modeling, animation, and rendering suite (CPE cpe:2.3:a:autodesk:3ds_max) that natively imports a wide range of legacy image formats, including the SGI RGB raster format historically used as texture input. The root cause is classified as CWE-787 (Out-of-bounds Write), meaning the RGB parser fails to correctly validate length, offset, or channel fields in the file header or pixel stream and writes attacker-controlled bytes past the bounds of a heap or stack buffer. Because image parsing happens in-process inside the main 3ds Max executable, corruption directly affects the running application's memory and control flow, enabling code execution under the user's security context.

RemediationAI

Apply the fixed 3ds Max build identified in Autodesk security advisory ADSK-SA-2026-0002 (https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0002); exact patched version numbers are listed in that advisory and should be deployed through Autodesk Access. Until the patched build is rolled out, restrict 3ds Max workstations from opening RGB files from untrusted or external sources - block .rgb (and the related .sgi/.bw/.rgba variants) at email gateways and asset-ingest pipelines, require that third-party textures be converted to PNG or TIFF by an isolated conversion service before they reach artist workstations, and run 3ds Max under a non-administrator account so that successful exploitation is contained to the user's profile. The trade-off is that converting or blocking RGB files breaks legitimate workflows that consume SGI-format textures from vendors or legacy archives, so coordinate the block with asset-management teams.