Autodesk 3ds Max vulnerabilities

29 CVEs affecting Autodesk 3ds Max, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-7455, published 2026-08-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2009-3577, published 2009-11-24. High severity, CVSS 9.3. EPSS: 5.1% chance of exploitation in the next 30 days. Autodesk 3D Studio Max (3DSMax) 6 through 9 and 2008 through 2010 allows remote attackers to execute arbitrary code via a .max file with a MAXScript statement that calls the DOSCommand method,…
CVE-2022-27532, published 2022-06-16. High severity, CVSS 7.8. EPSS: 1% chance of exploitation in the next 30 days. A maliciously crafted TIF file in Autodesk 3ds Max 2022 and 2021 can be used to write beyond the allocated buffer while parsing TIF files. This vulnerability in conjunction with other vulnerabilities…
CVE-2022-27531, published 2022-06-16. High severity, CVSS 7.8. EPSS: 0.8% chance of exploitation in the next 30 days. A maliciously crafted TIF file can be forced to read beyond allocated boundaries in Autodesk 3ds Max 2022, and 2021 when parsing the TIF files. This vulnerability in conjunction with other…
CVE-2022-27871, published 2022-06-21. High severity, CVSS 7.8. EPSS: 0.8% chance of exploitation in the next 30 days. Autodesk AutoCAD product suite, Revit, Design Review and Navisworks releases using PDFTron prior to 9.1.17 version may be used to write beyond the allocated buffer while parsing PDF files. This…
CVE-2005-4710, published 2005-12-31. Medium severity, CVSS 4.6. EPSS: 0.6% chance of exploitation in the next 30 days. Unspecified vulnerability in multiple Autodesk and AutoCAD products and product families from 2006 and earlier allows remote attackers to "gain inappropriate access to another local user's computer,"…
CVE-2022-25793, published 2022-08-10. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. A Stack-based Buffer Overflow Vulnerability in Autodesk 3ds Max 2022, 2021, and 2020 may lead to code execution through the lack of proper validation of the length of user-supplied data prior to…
CVE-2023-25002, published 2023-06-27. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. A maliciously crafted SKP file in Autodesk products is used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution.
CVE-2026-0659, published 2026-02-04. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A maliciously crafted USD file, when loaded or imported into Autodesk Arnold or Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to…
CVE-2026-0660, published 2026-02-04. High severity, CVSS 8.4. EPSS: 0.2% chance of exploitation in the next 30 days. A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can cause a Stack-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary…
CVE-2026-0536, published 2026-02-04. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can cause a Stack-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary…

Latest

CVE-2026-7455, published 2026-08-24. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A maliciously crafted FLT file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data…
CVE-2026-19568, published 2026-08-24. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the…
CVE-2026-16783, published 2026-08-24. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. A maliciously crafted ABC file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data…
CVE-2026-16782, published 2026-08-24. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive…
CVE-2026-16781, published 2026-08-24. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to cause the application…
CVE-2026-7454, published 2026-05-26. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the…
CVE-2026-7453, published 2026-05-26. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can cause a Stack Exhaustion vulnerability, leading to a denial-of-service condition.
CVE-2026-7452, published 2026-05-26. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the…
CVE-2026-7451, published 2026-05-26. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A maliciously crafted TIF file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data…
CVE-2026-7450, published 2026-05-26. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A maliciously crafted PAR file, when parsed through Autodesk 3ds Max, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a…