Autodesk 3ds Max CVE-2026-7451

A user of Autodesk 3ds Max 2026 (<2026.1) or 2027 (<2027.1) must open or import a maliciously crafted TIF file - either directly or as an asset/texture referenced by a 3ds Max scene file - for the out-of-bounds write to trigger. Limiting factors per the CVSS vector: local attack vector (AV:L) means the file must reach the victim's machine via email, shared storage, supply-chain asset, or download; mandatory user interaction (UI:R) means automated/unattended exploitation against headless servers is not the threat model; no privileges are required (PR:N), so any 3ds Max user account is sufficient. Exploitation does not require network exposure or a vulnerable service, and code execution occurs in the security context of the user running 3ds Max, not SYSTEM.

The CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a classic file-format client-side bug: local attack vector, no privileges, but mandatory user interaction to open the file. SSVC corroborates this - Technical Impact is total but Exploitation is none and Automatable is no, meaning this is not a worm-grade flaw. EPSS at 0.01% (0th percentile) and the absence of CISA KEV listing indicate no observed in-the-wild abuse, and no public exploit identified at time of analysis. The realistic risk is targeted social-engineering or supply-chain delivery of poisoned .tif or scene files to artists/engineers, where successful exploitation yields code execution as the logged-in user - high-value on workstations that hold proprietary IP. Note one signal-tension: the CVE description says 'A malicious actor may leverage this vulnerability to cause… execute arbitrary code,' which is consistent with C:H/I:H/A:H, but actual exploitability depends on memory layout and mitigations (ASLR/DEP/CFG) on the host - verify with vendor advisory before assuming reliable RCE.

An attacker emails or shares a project archive containing a poisoned .tif texture (or a .max scene referencing one) to a 3ds Max artist; when the artist opens the scene or imports the texture, the TIFF parser performs an out-of-bounds write, corrupts memory, and runs attacker shellcode under the artist's user account - granting access to local design IP, cached credentials, and the corporate network. No public exploit is identified at time of analysis, but the bug class (heap/stack OOB write in an image parser) is well within reach of skilled exploit developers given the patch diff.