EUVD-2026-65153
GHSA-8m2g-7v38-37rw
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:L and UI:R because exploitation requires a user to open a crafted SVG locally; PR:N as no special privileges are needed beyond file access; full C/I/A because arbitrary code executes in the process context.
Primary rating from Vendor (autodesk).
CVSS VectorVendor: autodesk
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
AnalysisAI
Memory corruption via maliciously crafted SVG files in Autodesk 3ds Max allows arbitrary code execution within the current process context. The vulnerability is rooted in a classic buffer overflow (CWE-120) in the application's SVG parsing subsystem, triggered when a user opens a specially crafted file. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a victim open a maliciously crafted SVG file specifically using Autodesk 3ds Max - the vulnerable SVG parser must be invoked. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 score reflects serious impact (C:H/I:H/A:H) but the attack vector profile substantially constrains real-world risk: AV:L requires the malicious SVG to be present on the target system, AC:L indicates no special conditions once the file is delivered, and UI:R means a user must actively open the file. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the patched version of Autodesk 3ds Max detailed in security advisory ADSK-SA-2026-0014 at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0014. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Autodesk 3ds Max installations, issue security advisory to users to avoid opening SVG files from untrusted sources, and if technically feasible, disable SVG import functionality in application settings. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted GIF file, triggeri
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted RGB image file, re
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted RGB image file, tr
Stack-based buffer overflow in Autodesk 3ds Max enables arbitrary code execution when the application parses a malicious
Out-of-bounds read in Autodesk 3ds Max's SVG file parser enables crash, sensitive memory disclosure, or arbitrary code e
Out-of-bounds write in Autodesk 3ds Max's FLT file parser allows an attacker to cause a crash, corrupt data, or execute
Out-of-bounds write in Autodesk 3ds Max's Alembic (ABC) file parser enables arbitrary code execution in the context of t
Arbitrary code execution in Autodesk 3ds Max 2026 and 2027 occurs when the application parses a maliciously crafted WRL
Arbitrary code execution in Autodesk 3ds Max occurs when users open max files from maliciously crafted project directori
Arbitrary code execution in Autodesk 3ds Max 2026 (<2026.1) and 2027 (<2027.1) is possible when a user opens a malicious
Out-of-bounds write in Autodesk 3ds Max 2026 and 2027 enables arbitrary code execution when a user opens a maliciously c
Autodesk 3ds Max is vulnerable to arbitrary code execution when processing maliciously crafted GIF files due to a stack-
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today