Description

A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-24T21:16:48.900Z",
  "pubdate": "2026-08-24T21:16:48.900Z",
  "executiveSummary": "This vulnerability is an Out-of-Bounds Read flaw affecting Autodesk 3ds Max.\nThe vulnerability arises when the application parses a maliciously crafted SVG file, leading to memory exposure beyond the intended buffer boundaries.\nSuccessful exploitation of this flaw can result in application crashes, unauthorized disclosure of sensitive memory data, or arbitrary code execution within the security context of the currently running process.\nThe risk implication is high, as an attacker can compromise process integrity and confidentiality by leveraging user interaction to process the malicious file.\nAttack capabilities include reading arbitrary process memory or achieving code execution if combined with other primitives.\nExploitation requires a victim to open or import a specifically crafted SVG file within Autodesk 3ds Max.",
  "technicalDetails": "The root cause of the vulnerability is an improper bounds check during the parsing of SVG files within the Autodesk 3ds Max parser component.\nWhen the vulnerable component processes the maliciously crafted SVG file, it fails to validate input dimensions or coordinate indices against the allocated buffer size.\nThis lack of validation triggers an Out-of-Bounds Read condition, allowing the application to read data from adjacent memory regions.\nThe attack flow begins when an attacker delivers a malformed SVG file to a target user via social engineering or file-sharing vectors.\nUpon ingestion and parsing of the file by Autodesk 3ds Max, the memory corruption occurs.\nDepending on the specific memory layout and subsequent handling of the out-of-bounds data, the application may crash due to an access violation, leaking sensitive stack or heap data back to the execution context, or facilitating arbitrary code execution.\nPrivilege and authentication requirements are minimal from a network perspective, as the attack relies entirely on local file parsing; no network exposure or remote authentication is inherently required.\nThe attacker capabilities span denial of service via application termination, information disclosure of sensitive process memory contents, and potential arbitrary code execution under the privileges of the active user session running Autodesk 3ds Max."
}