Description
A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Published: 2026-08-04
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Autodesk FBX SDK contains a stack‑based buffer overflow in the fbxsdk::ExtractDrive routine that is triggered when parsing a specially crafted FBX file. When this vulnerability is exploited, an attacker can execute arbitrary code within the process that is running the SDK, effectively taking control of that process in the user’s context.

Affected Systems

The flaw affects Autodesk FBX SDK version 2020.3.9 and any installations that rely on that specific build. No other versions or products are currently listed as vulnerable.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity vulnerability. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector involves locally delivering a malicious FBX file to the SDK, such as by opening it or importing it within a trusted application. Because the flaw results in code execution in the context of the current process, it can lead to local privilege escalation or complete compromise of the host if the SDK runs with elevated rights.

Generated by OpenCVE AI on August 4, 2026 at 19:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Autodesk FBX SDK to a patched version that resolves the stack-based buffer overflow. Alert Autodesk support for the exact release that contains the fix.
  • If an immediate patch is unavailable, limit the processing of FBX files to trusted sources only and enforce strict file‑type validation before invoking the SDK. Consider rejecting files that do not meet the minimum structural requirements.
  • Deploy network and host‑based monitoring to detect anomalous process behavior or memory corruption events associated with FBX file handling.

Generated by OpenCVE AI on August 4, 2026 at 19:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 04 Aug 2026 13:15:00 +0000

Type Values Removed Values Added
Description A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Title FBX ExtractDrive Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDK
First Time appeared Autodesk
Autodesk fbx Sdk
Weaknesses CWE-121
CPEs cpe:2.3:a:autodesk:fbx_sdk:2020.3.9:*:*:*:*:*:*:*
Vendors & Products Autodesk
Autodesk fbx Sdk
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Autodesk Fbx Sdk
cve-icon MITRE

Status: PUBLISHED

Assigner: autodesk

Published:

Updated: 2026-08-05T03:56:13.210Z

Reserved: 2026-06-02T18:11:05.634Z

Link: CVE-2026-10710

cve-icon Vulnrichment

Updated: 2026-08-04T16:10:52.332Z

cve-icon NVD

Status : Received

Published: 2026-08-04T13:17:32.507

Modified: 2026-08-05T05:16:46.030

Link: CVE-2026-10710

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T10:20:03Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow