Autodesk 3ds Max EUVD-2026-31911

Exploitation requires a user of Autodesk 3ds Max 2026 (<2026.1) or 3ds Max 2027 (<2027.1) on a workstation to open or import an attacker-supplied WRL (VRML) file through the 3ds Max WRL/VRML import path - the vulnerable code is the WRL file parser, so any workflow that does not ingest .wrl files is not exposed. Limiting factors: CVSS UI:R confirms user interaction is mandatory (the file must be opened/imported, not merely present on disk); AV:L means there is no remote network reachability - the file must arrive via email, download, shared storage, or asset pipeline; PR:N means the attacker needs no prior credentials on the target host but the resulting code runs only at the victim user's privilege level (S:U, no scope change); and only the two named 2026/2027 release lines are listed as affected, so earlier supported releases and the already-patched .1 builds are out of scope based on the data provided.

The CVSS vector AV:L/AC:L/PR:N/UI:R paints this as a local, user-interaction-driven client-side bug - the 'local' vector reflects that the attacker delivers a file the victim must open rather than reaching the product over a network. Confidentiality, integrity, and availability impacts are all High, and SSVC agrees the technical impact is 'total,' but SSVC also marks Exploitation as 'none' and Automatable as 'no,' and EPSS sits at 0.01% (0th percentile), so this is not currently a mass-exploitation threat. It is not on CISA KEV and no public PoC is identified. Realistic risk is moderate and concentrated on organizations that routinely ingest third-party 3D assets (VFX studios, game studios, architectural/engineering firms, marketplaces) where booby-trapped WRL files can plausibly reach designers via email, asset packs, or supply-chain content; for shops that never touch WRL content the practical risk is low. No conflicting signals were observed in the provided data.

An attacker emails or hosts a malicious .wrl asset (for example, posing as a free VRML model on a 3D asset marketplace or as a vendor deliverable to a VFX artist) and convinces the victim to open or import it into 3ds Max. When the WRL parser processes the crafted geometry/strings, the buffer overflow corrupts memory and the attacker's shellcode executes as the logged-in designer, enabling credential theft, lateral movement, or tampering with production assets. No public exploit is identified at time of analysis, so an attacker would need to develop the exploit themselves.