Autodesk 3ds Max CVE-2026-16781

The victim must actively open a maliciously crafted SVG file within Autodesk 3ds Max; passive exposure (e.g., network scanning, web browsing) is insufficient. The CVSS vector (AV:L/UI:R) confirms local delivery and required user interaction. No authentication to any system is required - the attacker need only convince a 3ds Max user to open the file. Exploitation is limited to scenarios where SVG import is a supported workflow; if an organization's 3ds Max deployment does not involve SVG file ingestion, the practical risk is negligible. The vulnerability does not affect privileged system access, only the 3ds Max process itself.

The CVSS 3.1 base score of 5.5 (Medium) accurately reflects the constrained impact of this vulnerability. The attack vector is local (AV:L), meaning exploitation requires the victim to open a maliciously crafted file rather than exposing a remotely reachable service - significantly reducing opportunistic attack surface. User interaction is required (UI:R), adding a social engineering prerequisite. The scope is unchanged (S:U), confidentiality and integrity are unaffected (C:N/I:N), and impact is limited to a single application crash (A:H on the application, not the host OS). No EPSS data was provided, and the vulnerability is not in CISA KEV. The 'Information Disclosure' tag present in the source data appears to be a misclassification - the CVE description and CVSS vector both describe a pure availability (DoS) impact with no data exposure. Real-world priority is low; exploitation is most plausible in targeted attacks against 3D artists or engineers in industries such as film, architecture, or game development, where SVG import workflows are common.

An attacker crafts a malicious SVG file containing deeply or cyclically nested XML elements designed to trigger unbounded recursion in 3ds Max's parser, then delivers it to a target via email, a shared project repository, or a file-sharing platform commonly used in design workflows. When the victim opens the file in 3ds Max, the parser recurses until the stack is exhausted, causing the application to terminate unexpectedly and losing any unsaved work. No public proof-of-concept code has been identified, but the technique is straightforward for anyone familiar with SVG structure and stack-overflow exploitation patterns.