EUVD-2026-65150
GHSA-25qw-x66x-j232
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File parsed locally with no privileges needed, but user must open it; full C/I/A justified by RCE-capable OOB read within process context.
Primary rating from Vendor (autodesk).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
AnalysisAI
Out-of-bounds read in Autodesk 3ds Max's SVG file parser enables crash, sensitive memory disclosure, or arbitrary code execution within the 3ds Max process context when a user opens a maliciously crafted SVG file. Affected releases span 3ds Max 2026 prior to 2026.3.4 and 3ds Max 2027 prior to 2027.2.0, as confirmed by EUVD-2026-65150. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must actively open a maliciously crafted SVG file using an unpatched version of Autodesk 3ds Max (2026 prior to 2026.3.4 or 2027 prior to 2027.2.0) on a local workstation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.8 High reflects a worst-case scenario (full C/I/A) but the local attack vector (AV:L) and mandatory user interaction (UI:R) impose meaningful friction: an attacker must deliver the crafted SVG to the target machine and engineer the victim into opening it in 3ds Max. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Autodesk 3ds Max 2026.3.4 or later (for the 2026 release line) or to 2027.2.0 or later (for the 2027 release line), per the vendor advisory at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0014. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Autodesk 3ds Max installations and document affected versions (2026 pre-2026.3.4, 2027 pre-2027.2.0). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted GIF file, triggeri
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted RGB image file, re
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted RGB image file, tr
Stack-based buffer overflow in Autodesk 3ds Max enables arbitrary code execution when the application parses a malicious
Out-of-bounds write in Autodesk 3ds Max's FLT file parser allows an attacker to cause a crash, corrupt data, or execute
Memory corruption via maliciously crafted SVG files in Autodesk 3ds Max allows arbitrary code execution within the curre
Out-of-bounds write in Autodesk 3ds Max's Alembic (ABC) file parser enables arbitrary code execution in the context of t
Arbitrary code execution in Autodesk 3ds Max 2026 and 2027 occurs when the application parses a maliciously crafted WRL
Arbitrary code execution in Autodesk 3ds Max occurs when users open max files from maliciously crafted project directori
Arbitrary code execution in Autodesk 3ds Max 2026 (<2026.1) and 2027 (<2027.1) is possible when a user opens a malicious
Out-of-bounds write in Autodesk 3ds Max 2026 and 2027 enables arbitrary code execution when a user opens a maliciously c
Autodesk 3ds Max is vulnerable to arbitrary code execution when processing maliciously crafted GIF files due to a stack-
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today