Autodesk 3ds Max CVE-2026-16783

The victim must actively open a maliciously crafted ABC (Alembic) file using Autodesk 3ds Max - this is the sole triggering condition derived from the description and confirmed by the UI:R CVSS metric. No authentication, no network service, and no special configuration of 3ds Max is required beyond the application's default ability to parse ABC files. Exploitation is limited by the requirement for user interaction: the attacker cannot exploit this remotely without first convincing the target to open the file (social engineering, supply chain file substitution, or a compromised shared asset library). The local attack vector (AV:L) further constrains exploitation to scenarios where the malicious file reaches the target host. The scope is bounded to the 3ds Max process (S:U), so even successful exploitation does not automatically yield OS-level persistence or lateral movement without chaining additional techniques.

The CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a local, low-complexity attack requiring user interaction but no prior privileges. The local attack vector (AV:L) means an attacker cannot exploit this directly over the network; delivery of the malicious ABC file requires a social engineering step. However, the very low attack complexity (AC:L) and the fact that no privileges are required to open a file significantly lower the bar once the file reaches the victim. The scope is unscoped (S:U), meaning exploitation is contained to the current 3ds Max process, which limits lateral movement potential. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV and no public POC is known, suggesting opportunistic mass exploitation is not currently occurring. For studios and architects who receive ABC files from external vendors, contractors, or clients, the social engineering surface is realistic and the risk should be treated as moderate-to-high for those user populations specifically.

An attacker crafts a malicious Alembic (.abc) file with a manipulated buffer length or offset field designed to trigger an out-of-bounds write during 3ds Max's parsing routine, then delivers it to a target artist or architect via email, cloud storage share, or a compromised asset repository. When the victim opens the file in 3ds Max, the parser writes beyond the allocated buffer boundary, corrupting heap memory in a manner that allows the attacker to redirect control flow and execute arbitrary code under the victim's user account. No public POC exists at time of analysis, but the low attack complexity rating suggests the vulnerability is reliably triggerable once a working file sample is constructed.