What is the CVSS score of EUVD-2026-31910?

EUVD-2026-31910 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Autodesk 3ds Max are affected by EUVD-2026-31910?

Autodesk 3ds Max 2026 and 2027 contain a critical code execution vulnerability triggered by opening malicious TIF image files, directly threatening design and VFX workstations' data security and…. A patch is available.

How to fix or mitigate EUVD-2026-31910?

Within 24 hours: Identify all Autodesk 3ds Max 2026 and 2027 installations across design and VFX teams. Within 7 days: Apply the security patch released by Autodesk. Within 30 days: Implement endpoint controls restricting TIF file handling from untrusted sources and conduct security awareness training on file-handling risks.

Autodesk 3ds Max EUVD-2026-31910

| CVE-2026-7451 HIGH

Out-of-bounds Write (CWE-787)

2026-05-26 autodesk

GHSA-27pg-55mm-479g

Memory Corruption Buffer Overflow RCE 3ds Max

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:00 vuln.today

DescriptionCVE.org

A maliciously crafted TIF file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

AnalysisAI

Out-of-bounds write in Autodesk 3ds Max 2026 and 2027 enables arbitrary code execution when a user opens a maliciously crafted TIF image file, with impact ranging from process crash to data corruption to code execution in the context of the running application. The flaw requires local file handling and user interaction (UI:R), and there is no public exploit identified at time of analysis. EPSS is negligible (0.01%) and SSVC marks exploitation status as none, but the technical impact is rated total, making this a credible client-side risk for design and VFX workstations.

Technical ContextAI

The vulnerability is a CWE-787 Out-of-Bounds Write in the TIFF (TIF) image parser used by Autodesk 3ds Max, a Windows-based 3D modeling, animation, and rendering application identified by CPE cpe:2.3:a:autodesk:3ds_max. TIFF is a complex, tag-based raster format whose IFD entries, strip offsets, and length fields are notorious sources of memory-corruption bugs when input bounds are not validated; a malformed structure can cause the parser to write past the end of an allocated buffer on the heap or stack. Because 3ds Max embeds TIF handling for textures, reference images, and scene assets, simply loading an asset containing or referencing a crafted TIF can trigger the write, corrupting adjacent memory and enabling arbitrary code execution within the 3ds Max process.

RemediationAI

Vendor-released patch: upgrade 3ds Max 2026 to 2026.1 or later, and 3ds Max 2027 to 2027.1 or later, distributed via Autodesk Access (https://www.autodesk.com/products/autodesk-access/overview) as described in advisory ADSK-SA-2026-0006 (https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0006). Until patches are deployed, restrict 3ds Max users from opening TIF files or scenes from untrusted sources, route inbound asset deliveries through a sandbox or air-gapped triage workstation, and consider stripping or converting TIF assets to a re-encoded format (e.g., PNG via a hardened converter) before they reach artist workstations - the trade-off is broken color-depth/layered-TIFF workflows and additional pipeline friction. Application-level controls such as Windows Defender Exploit Guard (ACG, CFG, ASLR enforcement) on the 3dsmax.exe process can raise exploitation cost but will not eliminate the bug.