Description
A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to cause the application to terminate unexpectedly, resulting in a denial-of-service.
Published: 2026-08-24
Score: 5.5 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A maliciously crafted SVG file can trigger an uncontrolled recursion in Autodesk 3ds Max when parsed, causing the application to terminate unexpectedly. The severity is limited to denial of service against the running application, as the vulnerability does not grant command execution or data disclosure. The weakness lies in resource exhaustion due to recursion as identified by CWE‑674.

Affected Systems

Autodesk 3ds Max versions from 2026 through 2027 are affected. Any installation of the product that includes the SVG file parser without the latest patch is susceptible.

Risk and Exploitability

The CVSS score of 5.5 indicates a moderate risk. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is local file processing; an attacker can supply a crafted SVG file to a user who opens it in the application, leading to a denial of service. No remote exploitation path is documented, so mitigation focuses on preventing the user from opening untrusted files until patched.

Generated by OpenCVE AI on August 24, 2026 at 22:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest Autodesk 3ds Max update that resolves the stack exhaustion vulnerability.
  • Disallow opening of unknown or untrusted SVG files until the product is patched or the vulnerability is remediated.
  • Configure Autodesk 3ds Max to restrict automatic opening of external files or enforce file type validation to reduce injection of malformed SVG content.

Generated by OpenCVE AI on August 24, 2026 at 22:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to cause the application to terminate unexpectedly, resulting in a denial-of-service.
Title SVG File Parsing Stack Exhaustion Vulnerability in Autodesk 3ds Max
First Time appeared Autodesk
Autodesk 3ds Max
Weaknesses CWE-674
CPEs cpe:2.3:a:autodesk:3ds_max:2026:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:3ds_max:2027:*:*:*:*:*:*:*
Vendors & Products Autodesk
Autodesk 3ds Max
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Autodesk 3ds Max
cve-icon MITRE

Status: PUBLISHED

Assigner: autodesk

Published:

Updated: 2026-08-24T20:55:41.015Z

Reserved: 2026-07-23T17:47:19.522Z

Link: CVE-2026-16781

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-24T21:16:48.753

Modified: 2026-08-24T21:16:48.753

Link: CVE-2026-16781

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T23:00:06Z

Weaknesses