CVE-2026-0661

A maliciously crafted RGB file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.autodesk.com/products/autodesk-access/overview	Product
https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0002	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:autodesk:3ds_max:*:*:*:*:*:*:*:*

History

03 Jun 2026, 14:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~7.8~~	v2 : unknown v3 : 8.4
Summary		(es) Un archivo RGB creado maliciosamente, al ser analizado por Autodesk 3ds Max, puede forzar una vulnerabilidad de corrupción de memoria. Un actor malicioso puede aprovechar esta vulnerabilidad para ejecutar código arbitrario en el contexto del proceso actual.

06 Feb 2026, 16:26

Type	Values Removed	Values Added
First Time		Autodesk 3ds Max Autodesk
References	~~() https://www.autodesk.com/products/autodesk-access/overview -~~	() https://www.autodesk.com/products/autodesk-access/overview - Product
References	~~() https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0002 -~~	() https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0002 - Vendor Advisory
CPE		cpe:2.3:a:autodesk:3ds_max::::::::

04 Feb 2026, 17:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-04 17:16

Updated : 2026-06-03 14:16

NVD link : CVE-2026-0661

Mitre link : CVE-2026-0661

CVE.ORG link : CVE-2026-0661

JSON object : View

Products Affected

autodesk

3ds_max

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-0661", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "psirt@autodesk.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}, {"type": "Secondary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}]}, "published": "2026-02-04T17:16:12.947", "references": [{"url": "https://www.autodesk.com/products/autodesk-access/overview", "tags": ["Product"], "source": "psirt@autodesk.com"}, {"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0002", "tags": ["Vendor Advisory"], "source": "psirt@autodesk.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "psirt@autodesk.com", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A maliciously crafted RGB file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."}, {"lang": "es", "value": "Un archivo RGB creado maliciosamente, al ser analizado por Autodesk 3ds Max, puede forzar una vulnerabilidad de corrupci\u00f3n de memoria. Un actor malicioso puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo arbitrario en el contexto del proceso actual."}], "lastModified": "2026-06-03T14:16:32.723", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:autodesk:3ds_max:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF0B2FEF-FF28-4FF2-91CF-B417FB77CF04", "versionEndExcluding": "2026.3.2", "versionStartIncluding": "2026"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@autodesk.com"}