What is the CVSS score of CVE-2026-10709?

CVE-2026-10709 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Autodesk FBX SDK are affected by CVE-2026-10709?

CVE-2026-10709 in Autodesk FBX SDK enables arbitrary code execution on workstations when users import maliciously crafted FBX asset files, directly threatening creative and technology organizations…. A patch is available.

How to fix or mitigate CVE-2026-10709?

Within 24 hours, disable auto-import and auto-open features for FBX files across all affected Autodesk DCC tools and third-party game engine editors, and notify all users to refrain from opening FBX files from external or untrusted sources. Over the next 7 days, implement network controls to restrict FBX file downloads, audit logs for recent FBX asset imports, catalog all applications using the affected Autodesk FBX SDK, and contact relevant vendors for patching status and timelines. Within 30 days, monitor Autodesk security advisories for patch releases, conduct asset validation training with affected teams, and plan comprehensive testing before resuming normal FBX workflows once vendor patches are deployed and validated in your environment.

Autodesk FBX SDK CVE-2026-10709

EUVD-2026-52669 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-08-04 psirt@autodesk.com

GHSA-j7mv-c9pm-mjgm

RCE Buffer Overflow Stack Overflow Fbx Software Development Kit Autodesk

7.8

CVSS 3.1 · Vendor: autodesk

Severity by source

Vendor (autodesk) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File-open trigger is local (AV:L); no credentials needed to open a file (PR:N); user must actively open the crafted asset (UI:R); process-level full compromise with no scope change (S:U, C:H/I:H/A:H).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (autodesk).

CVSS VectorVendor: autodesk

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 04, 2026 - 14:16 EUVD

Analysis Generated

Aug 04, 2026 - 13:31 vuln.today

CVE Published

Aug 04, 2026 - 13:17 nvd

HIGH 7.8

DescriptionCVE.org

A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::FbxIO::BinaryReadSectionHeader. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

AnalysisAI

Stack-based buffer overflow in Autodesk FBX SDK's binary file parser allows arbitrary code execution when a user opens a maliciously crafted FBX file. The vulnerable function fbxsdk::FbxIO::BinaryReadSectionHeader fails to properly bound-check attacker-controlled data from binary section headers, overflowing the call stack and enabling control-flow hijacking in the context of the host process. Any application embedding the affected SDK version - including Autodesk DCC tools and third-party game engine editors - is exposed when users import FBX assets from untrusted sources; no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The Autodesk FBX SDK is a cross-platform C++ library that serves as the canonical read/write/conversion engine for the FBX interchange format, which encodes 3D geometry, skeletal animation, materials, and scene hierarchies. The library is embedded in Autodesk's own products (Maya, 3ds Max, MotionBuilder) and is broadly licensed for third-party integration in game engines and pipeline tooling. CWE-121 (Stack-based Buffer Overflow) identifies the root cause: during binary FBX parsing, fbxsdk::FbxIO::BinaryReadSectionHeader reads attacker-controlled length or data fields from the file without adequate bounds validation, writing past the end of a fixed-size stack buffer. The CVSS vector AV:L/UI:R confirms that the file must be opened locally by a user, consistent with a file-parsing trigger rather than a network-facing service. Because the SDK is statically or dynamically linked into host applications, the overflow executes in the address space and privilege level of whatever process opened the file.

RemediationAI

Upgrade to the patched Autodesk FBX SDK version identified in security advisory ADSK-SA-2026-0010 (https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0010); an exact fixed version number was not independently confirmed from the provided input data and must be obtained directly from the advisory. For Autodesk-branded products (Maya, 3ds Max, MotionBuilder) that bundle the SDK, apply the corresponding product update once released. As a compensating control prior to patching, restrict FBX file ingestion to cryptographically verified or internally-originated assets only, and avoid opening FBX files received via email, asset stores, or external collaboration channels. Pipeline operators embedding the SDK in custom tooling should consider isolating the FBX parsing step in a sandboxed subprocess with limited OS privileges (e.g., seccomp on Linux, AppContainer on Windows) to contain blast radius if exploitation occurs - note this adds architectural complexity and may introduce inter-process communication latency in high-throughput pipelines.