CVE-2026-16781: 
Autodesk 3ds Max vulnerability analysis and mitigation

CVE-2026-16781 is an Uncontrolled Recursion vulnerability in Autodesk 3ds Max triggered by parsing a maliciously crafted SVG file, resulting in a denial-of-service condition. It affects 3ds Max versions 2026.0.0 through 2026.3.4 (exclusive) and 2027.0.0 through 2027.2.0 (exclusive). The vulnerability was published on August 24, 2026, with a patch made available the same day. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Autodesk Advisory).

The vulnerability is classified as CWE-674 (Uncontrolled Recursion), meaning the SVG parser in Autodesk 3ds Max fails to properly limit the depth or number of recursive calls when processing certain SVG file structures. An attacker can craft an SVG file with deeply nested or self-referential elements that cause the parser to recurse without bound, exhausting the program stack or allocated memory. Exploitation requires local access and user interaction — specifically, a victim must open the malicious SVG file within 3ds Max. No privileges are required on the part of the attacker (GitHub Advisory, Autodesk Advisory).

Successful exploitation causes Autodesk 3ds Max to terminate unexpectedly, resulting in a denial-of-service for the affected user. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability of the application. Users may lose unsaved work, and repeated exploitation could disrupt productivity in design and media production environments (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.106% (2nd percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is non-automatable and requires user interaction, further limiting its practical risk (GitHub Advisory, Autodesk Advisory).

1. Craft malicious SVG: Create an SVG file containing deeply nested or recursively referencing elements (e.g., deeply nested <svg>, <use>, or <symbol> tags) designed to trigger unbounded recursion in 3ds Max's SVG parser.
2. Deliver the file: Distribute the malicious SVG to a target user via email attachment, shared network drive, or social engineering, disguising it as a legitimate asset file.
3. Induce user interaction: Persuade the victim to open or import the SVG file within Autodesk 3ds Max (versions 2026.x before 2026.3.4 or 2027.x before 2027.2).
4. Trigger crash: Upon parsing, the uncontrolled recursion exhausts stack or memory resources, causing 3ds Max to terminate unexpectedly and resulting in denial of service (GitHub Advisory).

• File System: Presence of unexpected or unsolicited SVG files in project directories or download folders, particularly with unusual nesting structures.
• Logs: Application crash logs or Windows Event Viewer entries showing unexpected termination of the 3ds Max process (e.g., 3dsmax.exe crash events with stack overflow or out-of-memory errors).
• Process: Sudden, unexplained termination of the 3dsmax.exe process shortly after opening an SVG file, without prior user-initiated close action.

Autodesk has released patched versions addressing this vulnerability: 3ds Max 2026.3.4 and 3ds Max 2027.2. Users should update to these versions or later via Autodesk Access. As an interim workaround, restrict users from opening SVG files from untrusted sources within 3ds Max, and educate users to avoid importing SVG assets received from unknown parties (Autodesk Advisory, GitHub Advisory).