The vulnerability is a stack‑based buffer overflow that occurs when Autodesk 3ds Max parses a maliciously crafted GIF file. This flaw allows an attacker to execute arbitrary code with the permissions of the 3ds Max process, potentially compromising confidentiality, integrity, or availability of the host system. The weakness corresponds to CWE‑121.

Autodesk 3ds Max is affected, with the CPEs indicating the 2026 release as an example. All installations that support GIF image import, including the 2026 version and earlier releases, are potentially vulnerable until a patch is applied.

Execution requires an attacker to supply a malformed GIF to a user running 3ds Max, so the primary exploitation vector is a local or user‑initiated file import, although files obtained over a shared network could also be used. The CVSS score of 8.4 indicates high severity, while the EPSS score of <1% suggests a low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is local file import or shared file access.