CVE-2026-10710

FBX ExtractDrive Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDK

Published Aug 4, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

Analysis

Technical impact

Autodesk FBX SDK contains a stack‑based buffer overflow in the fbxsdk::ExtractDrive routine that is triggered when parsing a specially crafted FBX file. When this vulnerability is exploited, an attacker can execute arbitrary code within the process that is running the SDK, effectively taking control of that process in the user’s context.

Affected Systems

The flaw affects Autodesk FBX SDK version 2020.3.9 and any installations that rely on that specific build. No other versions or products are currently listed as vulnerable.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity vulnerability. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector involves locally delivering a malicious FBX file to the SDK, such as by opening it or importing it within a trusted application. Because the flaw results in code execution in the context of the current process, it can lead to local privilege escalation or complete compromise of the host if the SDK runs with elevated rights.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Autodesk

FBX SDK

unaffected

Version	Status	Constraints
`2020.3.9`	affected	< 2020.3.10

Configuration 1 [-]

cpe:2.3:a:autodesk:fbx_software_development_kit:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Autodesk

Fbx Sdk

Version	Status	Scheme	Platform
`[2020.3.9,2020.3.10)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Autodesk FBX SDK to a patched version that resolves the stack-based buffer overflow. Alert Autodesk support for the exact release that contains the fix.
If an immediate patch is unavailable, limit the processing of FBX files to trusted sources only and enforce strict file‑type validation before invoking the SDK. Consider rejecting files that do not meet the minimum structural requirements.
Deploy network and host‑based monitoring to detect anomalous process behavior or memory corruption events associated with FBX file handling.

Generated by OpenCVE AI on August 4, 2026 at 19:58 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.209% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.autodesk.com/products/autodesk-access/overview
https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0010

History

Sep 4, 2026 2:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Autodesk fbx Software Development Kit
CPEs		cpe:2.3:a:autodesk:fbx_software_development_kit::::::::
Vendors & Products		Autodesk fbx Software Development Kit

Aug 4, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 4, 2026 1:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Title		FBX ExtractDrive Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDK
First Time appeared		Autodesk Autodesk fbx Sdk
Weaknesses		CWE-121
CPEs		cpe:2.3:a:autodesk:fbx_sdk:2020.3.9:::::::*
Vendors & Products		Autodesk Autodesk fbx Sdk
References		https://www.autodesk.com/products/autodesk-access/overview https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0010
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`