The vulnerability is a stack-based buffer overflow triggered when Autodesk 3ds Max parses a maliciously crafted GIF file. This flaw allows an attacker to execute arbitrary code in the context of the 3ds Max process, compromising confidentiality, integrity, or availability of the host system. The flaw corresponds to CWE‑121.

The issue affects Autodesk 3ds Max, documented for the 2026 release and likely for earlier editions that handle GIF images. No specific version numbers are listed, so all installations that process GIF files are potentially vulnerable until a patch is applied.

Execution requires an attacker to supply a malformed GIF to a user running 3ds Max, so the primary exploitation vector is a local or user‑initiated file import, although network‑shared files could also be used. The CVSS score of 7.8 indicates high severity, but the EPSS indicates a low probability of exploitation, and the vulnerability is not yet listed in CISA’s KEV catalog. Nevertheless, the ability to run arbitrary code warrants prompt remediation.