The vulnerability arises from an out‑of‑bounds write during parsing of a malicious RGB file. This corrupted memory can be used to execute arbitrary code in the context of the running Autodesk 3ds Max process, leading to a full remote code execution condition. The weakness is a classic buffer overflow, classified as CWE‑787.

All releases of Autodesk 3ds Max are affected, as indicated by the vendor and product list. No specific version constraints were provided, so apply the guidance to all current and legacy builds.

The CVSS score of 7.8 highlights a substantial impact if exploited. The very low EPSS score of less than 1% suggests that attacks are infrequent at present, and the vulnerability is not yet listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation would typically require an attacker to supply a crafted RGB file that the user or a compromised process subsequently parses, implying a local or user‑initiated attack vector unless RGB files are accepted from external sources.