EUVD-2026-31909
GHSA-wg67-8wgj-6fhq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious PAR file with null-triggering parser input
-
DeliveryDeliver file to target via phishing or shared resource
-
ExploitVictim opens PAR file in unpatched 3ds Max 2026/2027
-
ExecutionNULL pointer dereference triggered in PAR parser
-
ImpactApplication crash causes denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the victim be running an unpatched version of Autodesk 3ds Max (2026 prior to 2026.1, or 2027 prior to 2027.1) on a local system, and must be socially engineered into manually opening a maliciously crafted PAR file - confirmed by CVSS UI:R. The attack vector is strictly local (AV:L), meaning the attacker cannot trigger the crash remotely without first delivering the file and having the user open it. No authentication is required on the part of the attacker (PR:N), but the mandatory user interaction (UI:R) is a meaningful limiting factor. Exploitation is not automatable per SSVC. No special application configuration or feature enablement is required beyond having 3ds Max installed and running. |
| Impact | The aggregated signal across all available data sources consistently rates this as low real-world priority. CVSS 5.5 (Medium) reflects the local attack vector (AV:L) and mandatory user interaction (UI:R), both of which substantially constrain exploitability compared to remotely triggered vulnerabilities. EPSS sits at 0.00% in the 0th percentile - among the least likely CVEs to be exploited in the near term. SSVC further confirms: exploitation status 'none', automatable 'no' (human interaction is required to open the file), and technical impact 'partial' (DoS only, no code execution or data exposure). The vulnerability is not listed in CISA KEV, and no POC or exploit code has been identified. The primary realistic attacker scenario is a targeted spear-phishing or social engineering effort against a 3ds Max user - opportunistic, mass exploitation is not feasible given the local/user-interaction constraints. There are no conflicting signals in the dataset; all sources align on low urgency. |
| Exploit ScenarioDerived | An attacker crafts a malformed PAR particle archive file designed to trigger a null pointer dereference in 3ds Max's parser, then delivers it to a target 3ds Max user via phishing email, file-sharing platform, or a compromised asset library. When the victim opens the file in an unpatched version of 3ds Max 2026 or 2027, the application immediately crashes, disrupting any active work session. No public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
NULL Pointer Dereference in Autodesk 3ds Max's PAR file parser allows a local attacker to crash the application by convincing a user to open a specially crafted PAR file, resulting in a denial-of-service condition. Affected versions span both the 2026 (prior to 2026.1) and 2027 (prior to 2027.1) release lines. No active exploitation has been identified - EPSS is 0.00% (0th percentile), SSVC exploitation status is 'none', and the vulnerability is not listed in CISA KEV - placing this squarely in a low-urgency, patch-and-monitor posture.
RemediationAI
The primary fix is to upgrade to Autodesk 3ds Max 2026.1 or 3ds Max 2027.1, which are the patched releases confirmed by EUVD-2026-31909. Autodesk's official advisory at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0006 should be consulted for patch delivery details; updates are available through the Autodesk Access tool referenced at https://www.autodesk.com/products/autodesk-access/overview. As a compensating control for organizations unable to patch immediately, instruct users not to open PAR files received from untrusted or unverified sources, and consider implementing file-type filtering at email and web gateways to quarantine unexpected PAR attachments for manual review - note this approach does not prevent exploitation through other delivery channels such as shared drives or USB media.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PAR files are Particle system Archive files used by Autodesk 3ds Max (CPE: cpe:2.3:a:autodesk:3ds_max:*:*:*:*:*:*:*:*) to store and transfer particle system data. The root cause is CWE-476 (NULL Pointer Dereference): during parsing of a malformed PAR file, the application dereferences a pointer that was never properly initialized or validated, causing an access violation. The CVSS vector AV:L/AC:L/PR:N/UI:R/S:U confirms this is a client-side file-parsing vulnerability - the attack is local, requires no attacker privileges, demands that the victim open the malicious file, and has no scope change. Impact is limited entirely to availability (A:H), with no confidentiality or integrity effects, consistent with a pure crash/DoS class defect.
Know when 3ds Max gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from Vendor (autodesk) · only source for this CVE.
CVSS VectorVendor: autodesk
Lifecycle Timeline
1DescriptionCVE.org
A maliciously crafted PAR file, when parsed through Autodesk 3ds Max, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted GIF file, triggeri
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted RGB image file, re
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted RGB image file, tr
Stack-based buffer overflow in Autodesk 3ds Max enables arbitrary code execution when the application parses a malicious
Out-of-bounds read in Autodesk 3ds Max's SVG file parser enables crash, sensitive memory disclosure, or arbitrary code e
Out-of-bounds write in Autodesk 3ds Max's FLT file parser allows an attacker to cause a crash, corrupt data, or execute
Memory corruption via maliciously crafted SVG files in Autodesk 3ds Max allows arbitrary code execution within the curre
Out-of-bounds write in Autodesk 3ds Max's Alembic (ABC) file parser enables arbitrary code execution in the context of t
A maliciously crafted DWG file, when parsed through Autodesk 3ds Max, can force a Use-After-Free vulnerability. Rated hi
A maliciously crafted JPG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. Ra
Arbitrary code execution in Autodesk 3ds Max 2026 and 2027 occurs when the application parses a maliciously crafted WRL
Arbitrary code execution in Autodesk 3ds Max occurs when users open max files from maliciously crafted project directori
Exploit-DB