A maliciously crafted GIF file can trigger an out‑of‑bounds write when parsed in Autodesk 3ds Max. The vulnerability, identified as CWE‑787, permits an attacker to overwrite memory outside the intended bounds and ultimately execute arbitrary code within the context of the running 3ds Max process. This can compromise confidentiality, integrity, and availability of the system where the application is running.

The issue affects Autodesk 3ds Max. No specific version range is listed, so all current installations that have not been updated beyond the latest release are potentially vulnerable. The affected system is the 3ds Max application itself, as noted by Autodesk in its advisory.

The CVSS base score of 7.8 classifies the vulnerability as high severity. The EPSS score of <1% indicates that the likelihood of exploitation is low at present, and the vulnerability is not yet listed in the CISA KEV catalog. However, exploitation is still possible if an attacker gains access to a system that stores or opens untrusted GIF files. The attack vector is most likely local; an attacker could supply a malicious GIF through a file upload or import operation, causing the vulnerable code to write out of bounds and run arbitrary code within the application’s process.