Autodesk 3ds Max CVE-2026-19568

Exploitation requires that a victim open a maliciously crafted SVG file specifically using Autodesk 3ds Max - the vulnerable SVG parser must be invoked. The CVSS AV:L vector confirms the attacker cannot trigger the vulnerability remotely without user interaction; the file must be present on the local system and the user must open it (UI:R). PR:N indicates no authenticated session or elevated privileges are needed to open a file, lowering the bar once delivery succeeds. Exploitation is fundamentally limited by the social engineering step required to deliver and induce opening of the malicious file; remote unauthenticated exploitation without user interaction is not possible. Other SVG parsers and applications are not affected - the flaw is specific to 3ds Max's SVG handling subsystem.

The CVSS 7.8 score reflects serious impact (C:H/I:H/A:H) but the attack vector profile substantially constrains real-world risk: AV:L requires the malicious SVG to be present on the target system, AC:L indicates no special conditions once the file is delivered, and UI:R means a user must actively open the file. This is a file-parsing RCE - the classic threat model for design and engineering workplaces where file exchange via email, cloud storage, or project repositories is routine. No EPSS score was provided in the available data, limiting probabilistic exploitation assessment. The absence of a CISA KEV listing and absence of confirmed POC code suggest this has not seen broad opportunistic exploitation, but the threat of targeted spear-phishing against architects, engineers, or media professionals remains real given the high-value nature of their systems and data. The risk is most acute in environments where 3ds Max users routinely open externally sourced asset files without verification.

An attacker crafts a malicious SVG file with embedded data engineered to trigger a buffer overflow in 3ds Max's SVG parser, then delivers it to a target - likely a designer, architect, or engineer - via email attachment, shared project folder, or asset marketplace. When the victim opens the file in 3ds Max, the overflow corrupts process memory and redirects execution to attacker-controlled code, achieving RCE as the logged-in user with no additional privilege escalation required. No confirmed POC exploit code exists at time of analysis.