EUVD-2026-31915
GHSA-rcgw-6xcq-f735
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (autodesk) · only source for this CVE.
CVSS VectorVendor: autodesk
Lifecycle Timeline
1DescriptionCVE.org
A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
AnalysisAI
Arbitrary code execution in Autodesk 3ds Max 2026 and 2027 occurs when the application parses a maliciously crafted WRL (VRML) file, leading to memory corruption that runs attacker-controlled code in the context of the current user. The flaw requires user interaction to open a malicious file and has no public exploit identified at time of analysis, with EPSS estimating only a 0.01% exploitation probability over the next 30 days. SSVC rates technical impact as total but classifies exploitation as 'none' and not automatable, consistent with a client-side file-format attack rather than a wormable internet-facing flaw.
Technical ContextAI
The vulnerability resides in 3ds Max's parser for WRL files, the textual scene-description format defined by VRML (Virtual Reality Modeling Language), commonly imported into 3D modeling pipelines. The root cause maps to CWE-120 (Classic Buffer Overflow / Copy without Checking Size of Input), meaning the parser writes attacker-controlled data into a fixed-size buffer without proper bounds validation, corrupting adjacent memory structures such as return addresses, function pointers, or heap metadata. The CPE cpe:2.3:a:autodesk:3ds_max:*:*:*:*:*:*:*:* indicates the issue is in the core 3ds Max application binary, and EUVD-listed versions narrow exposure to the 2026 and 2027 product lines prior to their respective .1 maintenance releases.
RemediationAI
Vendor-released patches are available: upgrade Autodesk 3ds Max 2026 to 2026.1 or later and 3ds Max 2027 to 2027.1 or later, distributed through Autodesk Access at https://www.autodesk.com/products/autodesk-access/overview as referenced in advisory ADSK-SA-2026-0006 (https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0006). Until patching is complete, instruct artists and pipeline engineers to refuse WRL files from untrusted sources and to open suspect scene assets only inside a non-privileged sandboxed workstation or VM, accepting the trade-off of slower asset review workflows. Where feasible, block .wrl attachments at the email gateway and strip them from external file-share ingestion, recognizing this will impact legitimate VRML interchange with external partners.
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted GIF file, triggeri
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted RGB image file, re
Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted RGB image file, tr
Stack-based buffer overflow in Autodesk 3ds Max enables arbitrary code execution when the application parses a malicious
Out-of-bounds read in Autodesk 3ds Max's SVG file parser enables crash, sensitive memory disclosure, or arbitrary code e
Out-of-bounds write in Autodesk 3ds Max's FLT file parser allows an attacker to cause a crash, corrupt data, or execute
Memory corruption via maliciously crafted SVG files in Autodesk 3ds Max allows arbitrary code execution within the curre
Out-of-bounds write in Autodesk 3ds Max's Alembic (ABC) file parser enables arbitrary code execution in the context of t
Arbitrary code execution in Autodesk 3ds Max occurs when users open max files from maliciously crafted project directori
Arbitrary code execution in Autodesk 3ds Max 2026 (<2026.1) and 2027 (<2027.1) is possible when a user opens a malicious
Out-of-bounds write in Autodesk 3ds Max 2026 and 2027 enables arbitrary code execution when a user opens a maliciously c
Autodesk 3ds Max is vulnerable to arbitrary code execution when processing maliciously crafted GIF files due to a stack-
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today