An out-of-bounds write occurs when Autodesk 3ds Max parses a malicious TIF file, permitting memory corruption that can result in application crashes, data corruption or execution of arbitrary code in the context of the user’s current process. The CVSS score of 7.8 highlights the significance of this flaw, while the absence of an EPSS score indicates limited current exploitation data but does not diminish the potential for impact.

All versions of Autodesk 3ds Max 2026 and 2027 are affected, as identified by the CNA product list. The vulnerability is triggered whenever the software processes a crafted TIF file, regardless of the end user’s privileges.

Moderate to high risk is indicated by a CVSS of 7.8, and the vulnerability is not listed in CISA KEV, suggesting that publicly known exploit tooling is currently limited. The likely attack vector is local; an adversary supplies a malicious TIF file that an end user opens. No remote network component is required, so the threat surface is confined to users who run untrusted TIF files within 3ds Max.