Autodesk 3ds Max is vulnerable to an out-of-bounds write flaw that could allow an attacker to execute arbitrary code via a specially crafted JPG file.

This is an out-of-bounds write vulnerability (CWE-787) triggered during the parsing of image files. The vulnerability can be exploited by an unauthenticated attacker if they successfully entice a user to open a malicious JPG file within the software.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the current user. Given the CVSS score of 7.8, this represents a high-severity risk that could lead to full system compromise, data theft, or the installation of persistent malware within the production environment.

Immediate Action: Update Autodesk 3ds Max to version 2026.3 or later immediately to resolve the memory corruption flaw.

Proactive Monitoring: Monitor workstation file system activity and process execution logs for unusual behavior originating from the 3ds Max application process.

Compensating Controls: Implement strict controls regarding the origin of external assets and ensure that users only open files from trusted sources to prevent the parsing of malicious images.

Public Exploit Available: No

This vulnerability poses a significant risk to workstations running Autodesk 3ds Max. Administrators should prioritize the deployment of the provided security update to ensure the software properly validates image input and prevents memory corruption. Failure to patch may expose systems to arbitrary code execution attacks.