What is the CVSS score of CVE-2026-0662?

CVE-2026-0662 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of 3ds Max are affected by CVE-2026-0662?

CVE-2026-0662 affects Autodesk 3ds Max users and poses a critical risk of arbitrary code execution when opening malicious project files.

How to fix or mitigate CVE-2026-0662?

Within 24 hours: Disable 3ds Max or restrict its use to trusted internal projects only; issue security alert to all users with usage guidelines. Within 7 days: Inventory all 3ds Max installations; implement file-source restrictions and user training on not opening suspicious project files. Within 30 days: Evaluate alternative workflows, monitor for patch availability from Autodesk, and consider restricting 3ds Max access to air-gapped or sandboxed environments until a patch is released.

3ds Max CVE-2026-0662

HIGH

Untrusted Search Path (CWE-426)

2026-02-04 psirt@autodesk.com

Privilege Escalation RCE 3ds Max

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 04, 2026 - 17:16 nvd

HIGH 7.8

DescriptionCVE.org

A maliciously crafted project directory, when opening a max file in Autodesk 3ds Max, could lead to execution of arbitrary code in the context of the current process due to an Untrusted Search Path being utilized.

AnalysisAI

Arbitrary code execution in Autodesk 3ds Max occurs when users open max files from maliciously crafted project directories that exploit an untrusted search path vulnerability. Local attackers can leverage this to execute arbitrary code with the privileges of the current user without requiring special permissions or interaction beyond opening a file. No patch is currently available for this high-severity vulnerability affecting 3ds Max users.

Technical ContextAI

Classified as CWE-426 (Untrusted Search Path). Affects 3Ds Max. A maliciously crafted project directory, when opening a max file in Autodesk 3ds Max, could lead to execution of arbitrary code in the context of the current process due to an Untrusted Search Path being utilized.