CVE-2009-3577: Autodesk 3ds Max

High severity, CVSS 9.3. EPSS: 5.1% chance of exploitation in the next 30 days.

Autodesk 3D Studio Max (3DSMax) 6 through 9 and 2008 through 2010 allows remote attackers to execute arbitrary code via a .max file with a MAXScript statement that calls the DOSCommand method, related to "application callbacks."

Affected products

• Autodesk 3ds Max: version 6 only; version 7 only; version 8 only; version 9 only; version 2008 only; version 2009 only; …

Published 2009-11-24. Last modified 2026-06-16.