Autodesk 3ds Max CVE-2026-7453

Exploitation requires that a local user manually open a maliciously crafted WRL file within an affected version of Autodesk 3ds Max - this is confirmed by AV:L (local attack vector) and UI:R (user interaction required) in the CVSS vector. The WRL/VRML import functionality must be accessible and enabled within 3ds Max; disabling or removing this import path would prevent exploitation. The vulnerability is version-scoped to 3ds Max 2026 prior to 2026.1 and 2027 prior to 2027.1 - patched or out-of-range versions are not affected. There is no network-facing component and no remote trigger mechanism; the attack cannot be initiated without the target user actively opening the file. The attack is not automatable per SSVC assessment. Impact is strictly limited to an application-level crash - code execution, privilege escalation, and data exfiltration are not possible outcomes of this vulnerability.

The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H reflects a local, file-triggered attack requiring user interaction, with impact strictly limited to availability - no confidentiality or integrity compromise is possible. The score of 5.5 (Medium) is appropriate and does not understate risk. EPSS at 0.00% in the 0th percentile is a strong signal that this vulnerability class and product combination are effectively unexploited at time of analysis. The SSVC assessment reinforces this: exploitation status is none, the attack is not automatable (manual social engineering required), and technical impact is only partial. KEV status is not confirmed. One data conflict worth flagging: the intelligence tags include 'Information Disclosure,' which directly contradicts the CVSS impact scores showing C:N - no confidentiality impact is indicated anywhere else in the dataset. This tag appears to be a metadata classification error and should not inform risk decisions. Net assessment: this is a real but low-priority vulnerability suitable for standard patching cycles, not emergency response.

An attacker crafts a WRL file containing deeply nested or cyclically referencing VRML node structures specifically designed to cause unbounded recursion in 3ds Max's parser. The file is delivered to a target 3D artist or designer via a phishing email, compromised asset repository, or malicious download link - social engineering is required since the victim must manually open the file in 3ds Max. Upon opening, the recursive parser exhausts the call stack, immediately crashing the application and destroying any unsaved work, constituting a denial-of-service. No public exploit code has been identified at time of analysis.