CVE-2026-0537: 
Autodesk 3ds Max vulnerability analysis and mitigation

CVE-2026-0537 is a memory corruption vulnerability in Autodesk 3ds Max's RGB file parser that allows arbitrary code execution in the context of the current process. It affects Autodesk 3ds Max versions 2026 through 2026.3.1 (i.e., all 2026 releases prior to 2026.3.2). The vulnerability was published on February 4, 2026, with a patch made available shortly after. It carries a CVSS v3.1 base score of 8.4 (High) per NVD, or 7.8 (High) per the ENISA/Autodesk scoring that accounts for required user interaction (Autodesk Advisory, Red Hat CVE).

The root cause is an out-of-bounds write (CWE-787) triggered during the parsing of a maliciously crafted RGB image file within Autodesk 3ds Max. When the application processes such a file, improper memory handling leads to a memory corruption condition that can be leveraged to redirect execution flow and run attacker-controlled code. Exploitation requires a user to open a malicious RGB file (user interaction), but no special privileges are needed. No public proof-of-concept or detailed technical write-up has been identified at this time (Autodesk Advisory, Red Hat CVE).

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running Autodesk 3ds Max, resulting in high confidentiality, integrity, and availability impacts. This could enable unauthorized access to sensitive project files and system data, modification or deletion of files, and disruption of the application or underlying system. The attack is limited to the local context (the user must open a malicious file), but in creative or engineering environments where RGB files are routinely shared, the risk of social engineering-based delivery is meaningful (Autodesk Advisory).

1. Craft malicious RGB file: An attacker creates a specially crafted RGB image file designed to trigger an out-of-bounds write in Autodesk 3ds Max's file parser, embedding a payload to redirect execution.
2. Deliver the file: The attacker delivers the malicious RGB file to a target user via email attachment, file-sharing platform, or a compromised asset repository commonly used in 3D design workflows.
3. Social engineering: The attacker convinces the target (e.g., a 3D artist or designer) to open the file in Autodesk 3ds Max, exploiting the trust placed in shared project assets.
4. Trigger memory corruption: Upon parsing the malicious RGB file, 3ds Max performs an out-of-bounds write, corrupting memory in a controlled manner.
5. Achieve code execution: The memory corruption condition is leveraged to redirect the instruction pointer and execute attacker-supplied shellcode or a payload in the context of the 3ds Max process, with the privileges of the logged-in user (Autodesk Advisory).

• File System: Unexpected RGB files in project directories or temp folders originating from external or untrusted sources; new or modified files created by the 3ds Max process in unusual locations.
• Process: Unusual child processes spawned by the Autodesk 3ds Max process (e.g., cmd.exe, powershell.exe, curl, wget); unexpected network connections initiated by the 3ds Max process.
• Network: Outbound connections from the 3ds Max process to unknown or suspicious external IP addresses or domains, particularly shortly after opening an RGB file.
• Logs: Application crash logs or Windows Event Logs indicating access violations or heap corruption in the 3ds Max process; unexpected process creation events logged by EDR solutions tied to the 3ds Max executable.

Autodesk has released a patch in version 2026.3.2, which resolves this vulnerability. Users should update Autodesk 3ds Max 2026 to version 2026.3.2 or later as the primary remediation. Until patching is complete, users should avoid opening RGB files from untrusted or unverified sources, and administrators should consider restricting file sharing of RGB assets from external parties. Implementing application-level monitoring for unusual process behavior from 3ds Max is also recommended as a compensating control (Autodesk Advisory).

The vulnerability received routine coverage from vulnerability tracking services and security feeds shortly after disclosure, including mentions on Mastodon via TheHackerWire and aggregation by platforms such as VulDB, CVEFeed, and RedPacket Security. No significant vendor statements beyond the Autodesk security advisory, nor notable independent researcher commentary or media investigations, have been identified for this CVE (Autodesk Advisory).