What is the CVSS score of CVE-2026-7454?

CVE-2026-7454 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Autodesk 3ds Max are affected by CVE-2026-7454?

Autodesk 3ds Max versions 2026 and 2027 contain an arbitrary code execution vulnerability triggered by opening malicious VRML files, giving attackers full system access under the current user's…. A patch is available.

How to fix or mitigate CVE-2026-7454?

Within 24 hours: Inventory all 3ds Max 2026/2027 installations and advise users to avoid opening WRL/VRML files from untrusted sources or external collaborators. Within 7 days: Deploy vendor patch to all affected 3ds Max instances via Autodesk's official update channels. Within 30 days: Confirm 100% patching completion, document version compliance, and consider implementing file-type restrictions or sandboxing for file-opening workflows.

Autodesk 3ds Max CVE-2026-7454

EUVD-2026-31915 HIGH

Classic Buffer Overflow (CWE-120)

2026-05-26 autodesk

GHSA-rcgw-6xcq-f735

Buffer Overflow RCE 3ds Max

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:02 vuln.today

DescriptionCVE.org

A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

AnalysisAI

Arbitrary code execution in Autodesk 3ds Max 2026 and 2027 occurs when the application parses a maliciously crafted WRL (VRML) file, leading to memory corruption that runs attacker-controlled code in the context of the current user. The flaw requires user interaction to open a malicious file and has no public exploit identified at time of analysis, with EPSS estimating only a 0.01% exploitation probability over the next 30 days. SSVC rates technical impact as total but classifies exploitation as 'none' and not automatable, consistent with a client-side file-format attack rather than a wormable internet-facing flaw.

Technical ContextAI

The vulnerability resides in 3ds Max's parser for WRL files, the textual scene-description format defined by VRML (Virtual Reality Modeling Language), commonly imported into 3D modeling pipelines. The root cause maps to CWE-120 (Classic Buffer Overflow / Copy without Checking Size of Input), meaning the parser writes attacker-controlled data into a fixed-size buffer without proper bounds validation, corrupting adjacent memory structures such as return addresses, function pointers, or heap metadata. The CPE cpe:2.3:a:autodesk:3ds_max:*:*:*:*:*:*:*:* indicates the issue is in the core 3ds Max application binary, and EUVD-listed versions narrow exposure to the 2026 and 2027 product lines prior to their respective .1 maintenance releases.

RemediationAI

Vendor-released patches are available: upgrade Autodesk 3ds Max 2026 to 2026.1 or later and 3ds Max 2027 to 2027.1 or later, distributed through Autodesk Access at https://www.autodesk.com/products/autodesk-access/overview as referenced in advisory ADSK-SA-2026-0006 (https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0006). Until patching is complete, instruct artists and pipeline engineers to refuse WRL files from untrusted sources and to open suspect scene assets only inside a non-privileged sandboxed workstation or VM, accepting the trade-off of slower asset review workflows. Where feasible, block .wrl attachments at the email gateway and strip them from external file-share ingestion, recognizing this will impact legitimate VRML interchange with external partners.