This flaw is an out‑of‑bounds write triggered when Autodesk 3ds Max parses a specially crafted RGB file. The resulting memory corruption allows an attacker to execute arbitrary code within the context of the process that is loading the file, potentially compromising the entire system. The weakness is identified as CWE‑787, which carries risks to confidentiality, integrity, and availability.

The vulnerability affects Autodesk 3ds Max 2026, as indicated by the CPE string. The advisory lists a generic wildcard for all 3ds Max versions, so installations of 2026 and potentially earlier releases may be vulnerable. Administrators should verify the installed version and apply the patch if available.

The CVSS score of 8.4 indicates high severity, but the EPSS score is below 1 %, suggesting that exploitation is currently unlikely. The vulnerability is not part of the CISA KEV catalog. The attack vector is inferred to be local or remote depending on how the malicious file is introduced—a malicious actor must supply the file to a user who opens it or to an automated import process. No publicly available exploit code is known at this time.