CVE-2026-16781: 
Autodesk 3ds Max vulnerability analysis and mitigation

CVE-2026-16781 is an Uncontrolled Recursion vulnerability in Autodesk 3ds Max triggered by parsing a maliciously crafted SVG file, resulting in a denial-of-service condition. It affects 3ds Max versions 2026.0.0 through 2026.3.4 (exclusive) and 2027.0.0 through 2027.2.0 (exclusive). The vulnerability was published on August 24, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium), assigned by Autodesk (GitHub Advisory, Autodesk Advisory).

The vulnerability is classified as CWE-674 (Uncontrolled Recursion), meaning the SVG parser in Autodesk 3ds Max does not properly limit the depth or number of recursive calls when processing certain SVG file structures. An attacker can craft an SVG file with deeply nested or self-referential elements that cause the parser to recurse uncontrollably, exhausting the program stack or allocated memory and causing an unexpected application termination. Exploitation requires local access and user interaction — specifically, a victim must open the malicious SVG file within 3ds Max (GitHub Advisory, Autodesk Advisory).

Successful exploitation results exclusively in a denial-of-service impact: the Autodesk 3ds Max application terminates unexpectedly, causing loss of availability and any unsaved work. There is no impact on confidentiality or data integrity, and the vulnerability's scope is limited to the affected application process. The attack does not facilitate lateral movement or data exfiltration (GitHub Advisory, Autodesk Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and user interaction, further limiting the practical attack surface (GitHub Advisory, Feedly).

1. Craft malicious SVG: Create an SVG file containing deeply nested or self-referential XML/SVG elements (e.g., recursive <use> references or excessively nested element trees) designed to trigger unbounded recursion in 3ds Max's SVG parser.
2. Deliver the file: Distribute the malicious SVG to a target user via email attachment, shared network drive, or social engineering, disguising it as a legitimate asset file.
3. Induce user interaction: Persuade the victim to open or import the crafted SVG file within Autodesk 3ds Max (versions 2026.0.0–2026.3.3 or 2027.0.0–2027.1.x).
4. Trigger denial-of-service: Upon parsing, the uncontrolled recursion exhausts the application stack or memory, causing 3ds Max to crash and terminate unexpectedly, resulting in loss of unsaved work (GitHub Advisory, Autodesk Advisory).

• File System: Presence of unexpected or unsolicited SVG files in directories accessible to 3ds Max users, particularly files with deeply nested XML structures.
• Logs: Application crash logs or Windows Event Viewer entries showing unexpected termination of the 3ds Max process (e.g., stack overflow or out-of-memory errors associated with the 3ds Max executable).
• Process: Sudden, unexplained crashes of the 3dsmax.exe process, especially when opening SVG files from external or untrusted sources.

Autodesk has released patched versions addressing this vulnerability: 3ds Max 2026.3.4 and 3ds Max 2027.2.0. Users should update to these versions or later via Autodesk Access. As an interim workaround, restrict users from opening SVG files from untrusted sources within 3ds Max, and educate users about the risks of opening files from unknown origins (Autodesk Advisory, GitHub Advisory).