What is the CVSS score of CVE-2026-10710?

CVE-2026-10710 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Autodesk FBX SDK are affected by CVE-2026-10710?

Autodesk FBX SDK contains a critical stack buffer overflow affecting any application that imports 3D assets-game engines, VFX platforms, and CAD tools used throughout your organization-allowing…. A patch is available.

How to fix or mitigate CVE-2026-10710?

Within 24 hours, inventory all applications embedding the Autodesk FBX SDK across your environment and immediately restrict FBX file imports to known-trusted internal sources only; disable FBX import from external suppliers, web downloads, and user-uploaded content. Within 7 days, implement supplemental controls including file format validation rules, network segmentation for asset processing workflows, and staff communications that restrict FBX handling to pre-vetted assets only. Within 30 days, establish continuous monitoring of Autodesk security advisories for patch release, evaluate alternative asset formats or sandbox solutions for FBX processing pipelines, and formalize an exception process for business-critical workflows that cannot be immediately paused.

Autodesk FBX SDK CVE-2026-10710

EUVD-2026-52670 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-08-04 psirt@autodesk.com

GHSA-pf7m-3rh5-7736

RCE Buffer Overflow Stack Overflow Fbx Software Development Kit Autodesk

7.8

CVSS 3.1 · Vendor: autodesk

Severity by source

Vendor (autodesk) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File-parsing vector requires local delivery and user interaction; no privileges needed; full process-level code execution but no OS boundary crossing.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (autodesk).

CVSS VectorVendor: autodesk

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 04, 2026 - 14:16 EUVD

Analysis Generated

Aug 04, 2026 - 13:30 vuln.today

CVE Published

Aug 04, 2026 - 13:17 nvd

HIGH 7.8

DescriptionCVE.org

A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

AnalysisAI

Stack-based buffer overflow in Autodesk FBX SDK's fbxsdk::ExtractDrive function allows arbitrary code execution in the context of the current process when a user opens a maliciously crafted FBX file. Any application embedding the FBX SDK for 3D asset import - including game engines, VFX pipelines, and CAD tools - inherits this attack surface, making the blast radius broader than the SDK itself. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-impact CVSS score (7.8) and RCE primitive make this a priority for organizations ingesting untrusted 3D content.

Technical ContextAI

The Autodesk FBX SDK is a C++ library for reading and writing FBX (Filmbox) files, the de-facto interchange format for 3D geometry, animation, and scene data. CWE-121 (Stack-Based Buffer Overflow) identifies the root cause: the function fbxsdk::ExtractDrive - likely responsible for parsing drive/path metadata within FBX file structures - does not perform adequate bounds checking on attacker-controlled input, allowing a crafted FBX payload to overflow the stack. Stack overflows at this layer can corrupt return addresses or function pointers, enabling control-flow hijacking and code execution. Because FBX SDK is a redistributed library, the vulnerability surfaces across every application that statically or dynamically links it, not just Autodesk's own products. No CPE strings were provided in the input; exact affected SDK versions should be confirmed via the Autodesk advisory ADSK-SA-2026-0010.

RemediationAI

The primary remediation is to apply the patch identified in Autodesk security advisory ADSK-SA-2026-0010 (https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0010). A specific patched version number was not present in the provided data and should be verified directly from that advisory before deployment. For organizations that cannot patch immediately, the most effective compensating control is to restrict ingestion of FBX files to trusted, integrity-verified sources only - for example, blocking FBX file receipt from external parties or enforcing digital signatures on 3D assets before import. Disabling or sandboxing the FBX import pipeline (e.g., running the parser in a restricted container or low-privilege process) limits the blast radius if exploitation occurs, at the cost of added operational complexity. Third-party software vendors who bundle the FBX SDK must independently patch and redistribute their applications; end-user patching of the SDK alone may not be sufficient if the embedding application ships its own SDK copy.