CVE-2026-7455: 
Autodesk 3ds Max vulnerability analysis and mitigation

CVE-2026-7455 is an Out-of-Bounds Write vulnerability in Autodesk 3ds Max triggered by parsing a maliciously crafted FLT file. A malicious actor may leverage this vulnerability to cause a crash, data corruption, or arbitrary code execution in the context of the current process. Affected versions include 3ds Max 2026.0.0 through 2026.3.4 (exclusive) and 2027.0.0 through 2027.2.0 (exclusive). The vulnerability was published on August 24, 2026, with a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Autodesk Advisory).

The vulnerability is classified as CWE-787 (Out-of-Bounds Write), occurring in the FLT file parser within Autodesk 3ds Max. When a specially crafted FLT file is opened, the parser writes data beyond the bounds of an allocated buffer, potentially corrupting adjacent memory. The attack vector is local, requires no privileges, but does require user interaction — specifically, a victim must open a malicious FLT file. No public proof-of-concept or detailed technical write-up has been identified at this time (GitHub Advisory, Autodesk Advisory).

Successful exploitation can result in application crashes (denial of service), data corruption, or arbitrary code execution within the security context of the user running 3ds Max. Because the vulnerability executes code at the privilege level of the current process, an attacker could gain access to files and resources accessible to the victim user. The technical impact is rated as total across confidentiality, integrity, and availability (GitHub Advisory, Autodesk Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not automatable and requires user interaction (opening a malicious FLT file), which limits its exploitability. The EPSS score is approximately 0.127%, placing it in the 3rd percentile for exploitation likelihood within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Craft a malicious FLT file: An attacker creates a specially crafted FLT (OpenFlight) file designed to trigger an out-of-bounds write when parsed by Autodesk 3ds Max's FLT file parser.
2. Deliver the file to the victim: The attacker distributes the malicious FLT file via email attachment, file-sharing platform, or a compromised project repository, targeting users of Autodesk 3ds Max 2026 or 2027.
3. Social engineering: The attacker convinces the victim to open the file in 3ds Max, for example by disguising it as a legitimate 3D scene or asset file.
4. Trigger the vulnerability: When the victim opens the file, the FLT parser writes data out of bounds, corrupting memory in the process.
5. Achieve code execution or crash: Depending on the crafted payload and memory layout, the attacker may achieve arbitrary code execution in the context of the victim's user account, or at minimum cause a denial of service via application crash (GitHub Advisory, Autodesk Advisory).

• File System: Unexpected or unsolicited FLT files received via email, messaging, or file-sharing platforms; FLT files with anomalous file sizes or structures inconsistent with legitimate OpenFlight assets.
• Process: Autodesk 3ds Max (3dsmax.exe) crashing unexpectedly or spawning unusual child processes (e.g., cmd.exe, powershell.exe, network utilities) after opening an FLT file.
• Logs: Windows Event Logs showing application crashes or access violations originating from 3dsmax.exe; crash dump files (.dmp) generated in the 3ds Max installation or user profile directory.
• Network: Unexpected outbound network connections from 3dsmax.exe to unknown external IP addresses following the opening of an FLT file.

Autodesk has released patched versions: 3ds Max 2026.3.4 and 3ds Max 2027.2. Users should update to these versions or later via Autodesk Access. As interim mitigations, users should avoid opening FLT files from untrusted or unknown sources, restrict FLT file import functionality if not operationally required, and implement file validation before processing. Educating users about the risks of opening unsolicited 3D asset files is also recommended (Autodesk Advisory, GitHub Advisory).

The vulnerability received routine coverage from vulnerability tracking services including VulDB, Tenable, and INCIBE-CERT shortly after disclosure. A mention was noted on Mastodon via The Hacker Wire. No significant researcher commentary, vendor statements beyond the official advisory, or major media coverage has been identified (Autodesk Advisory).