This flaw is an out‑of‑bounds write triggered when Autodesk 3ds Max parses a specially crafted RGB file. The resulting memory corruption allows an attacker to execute arbitrary code within the context of the process that is loading the file, potentially compromising the entire system. The weakness is identified as CWE‑787, which carries risks to confidentiality, integrity, and availability.

The vulnerability affects Autodesk 3ds Max, but specific affected build numbers are not listed in the advisory. Administrators should check the detailed security advisory for any version constraints; treating all installations as potentially vulnerable until patched is a prudent approach.

The CVSS score of 7.8 indicates high severity, but the EPSS score is below 1 %, suggesting that exploitation is currently unlikely. The vulnerability is not part of the CISA KEV catalog. The attack vector is inferred to be local or remote depending on how the malicious file is introduced—a malicious actor must supply the file to a user who opens it or to an automated import process. No publicly available exploit code is known at this time.