A malformed WRL file, when processed by Autodesk 3ds Max, triggers a memory corruption that can be exploited to run arbitrary code in the user’s process context. The vulnerability is a classic buffer overflow (CWE-120) that allows a malicious actor to take control of the application. If successful, the attacker can compromise the confidentiality, integrity, or availability of the system running 3ds Max, potentially leading to full system takeover if privileges are elevated.

This issue affects Autodesk 3ds Max versions 2026 and 2027. The vulnerability is tied to the WRL file parsing component in these releases. No further sub‑version detail is available at this time.

The CVSS score of 7.8 indicates a high severity. No EPSS score is reported, so the available probability of exploitation is unknown, but the potential impact is significant. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is triggered by a crafted file, the most likely attack vector is a local or remote user who is able to cause the software to open the malicious WRL file. No specific prerequisite authentication or privilege escalation is mentioned, implying that the vulnerability can be leveraged by any user running the application.