Executive brief
Autodesk 3ds Max is a professional 3D modeling and animation software used by designers and studios. A specially crafted SVG file can trigger an out-of-bounds memory read when opened, potentially allowing an attacker to crash the application, leak sensitive data from memory, or execute arbitrary code within the software.
Technical details
The vulnerability is an out-of-bounds read (CWE-125) in the SVG file parser of Autodesk 3ds Max. A malicious SVG file can be crafted to trigger memory access beyond allocated buffer boundaries when parsed by the application. The attack vector is local—an attacker must convince a user to open a malicious SVG file. Successful exploitation allows reading adjacent memory regions (information disclosure) or crashing the application (denial of service). More severe impact such as code execution is theoretically possible depending on memory layout and attacker control over the out-of-bounds access.
Affected products
- Autodesk 3ds Max
Timeline
- 2026-08-24: disclosed