Autodesk 3ds Max CVE-2026-7455

The victim must actively open a maliciously crafted FLT file within Autodesk 3ds Max - this is the sole trigger condition (UI:R). No special 3ds Max configuration, plugin, or non-default setting is required beyond the application's default FLT import capability being available. The attacker requires no system privileges on the target machine (PR:N); they only need a delivery mechanism for the malicious file (email, shared storage, download link). Exploitation is constrained to the security context of the currently logged-in user running 3ds Max (S:U, unchanged scope) - privilege escalation to OS-level admin is not directly implied by the CVSS vector. The attack is limited to Windows or other platforms where 3ds Max is deployed and FLT import is exercised.

The reported CVSS 7.8 (High) reflects a locally-triggered vulnerability with full C/I/A impact - a score consistent with file-parser RCE flaws. The AV:L/UI:R combination is a meaningful risk limiter: the attacker cannot exploit this remotely without first delivering the malicious file and inducing the user to open it, which requires a social engineering or supply-chain step. AC:L indicates no race condition or configuration bypass is needed once the file is opened, lowering the bar for weaponization post-delivery. No EPSS score was provided in the intelligence data - exploitation probability cannot be quantified numerically. The vulnerability is not listed in CISA KEV, indicating no confirmed in-the-wild exploitation at time of analysis. Taken together, this is a credible but delivery-dependent risk: the attack is straightforward once a target opens the file, but the file-delivery step gates widespread exploitation. Organizations whose workflows involve receiving FLT files from external parties (contractors, clients, asset marketplaces) face elevated realistic risk versus air-gapped pipelines.

An attacker crafts a maliciously structured FLT file engineered to trigger an out-of-bounds write in 3ds Max's parser and delivers it to a target - via email, a shared asset repository, or a compromised download source - with a pretext encouraging the recipient to open it (e.g., a 3D scene for review). When the victim opens the file in 3ds Max, the parser writes beyond allocated buffer bounds, potentially allowing the attacker to achieve arbitrary code execution running under the victim's user account. No public proof-of-concept exploit was identified at time of analysis.