EUVD-2026-65149
GHSA-gwqj-2wfr-ppm7
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
File-based local delivery (AV:L), no privileges needed (PR:N), user must open the file (UI:R), and impact is crash-only with no data exposure (C:N/I:N/A:H).
Primary rating from Vendor (autodesk).
CVSS VectorVendor: autodesk
Lifecycle Timeline
2DescriptionCVE.org
A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to cause the application to terminate unexpectedly, resulting in a denial-of-service.
AnalysisAI
Uncontrolled recursion in Autodesk 3ds Max's SVG parser allows a crafted file to exhaust the call stack and crash the application, resulting in denial of service. The attack requires user interaction - a victim must open a maliciously crafted SVG file - and has no impact on confidentiality or integrity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must actively open a maliciously crafted SVG file within Autodesk 3ds Max; passive exposure (e.g., network scanning, web browsing) is insufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.5 (Medium) accurately reflects the constrained impact of this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Autodesk security advisory ADSK-SA-2026-0014 at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0014 for the vendor-recommended patch and affected version details; no specific fixed version was included in the provided data, so a patched release cannot be independently confirmed at this time. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted GIF file, triggeri
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted RGB image file, re
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted RGB image file, tr
Stack-based buffer overflow in Autodesk 3ds Max enables arbitrary code execution when the application parses a malicious
Out-of-bounds read in Autodesk 3ds Max's SVG file parser enables crash, sensitive memory disclosure, or arbitrary code e
Out-of-bounds write in Autodesk 3ds Max's FLT file parser allows an attacker to cause a crash, corrupt data, or execute
Memory corruption via maliciously crafted SVG files in Autodesk 3ds Max allows arbitrary code execution within the curre
Out-of-bounds write in Autodesk 3ds Max's Alembic (ABC) file parser enables arbitrary code execution in the context of t
Arbitrary code execution in Autodesk 3ds Max 2026 and 2027 occurs when the application parses a maliciously crafted WRL
Arbitrary code execution in Autodesk 3ds Max occurs when users open max files from maliciously crafted project directori
Arbitrary code execution in Autodesk 3ds Max 2026 (<2026.1) and 2027 (<2027.1) is possible when a user opens a malicious
Out-of-bounds write in Autodesk 3ds Max 2026 and 2027 enables arbitrary code execution when a user opens a maliciously c
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today