A stack-based buffer overflow vulnerability in the Autodesk FBX SDK could allow an attacker to achieve arbitrary code execution or cause application crashes via a specially crafted file.

This is a stack-based buffer overflow (CWE-121) triggered within the fbxsdk::ExtractDrive function. The vulnerability requires user interaction, as the victim must open a malicious FBX file, and the attacker does not require prior authentication.

Successful exploitation of this vulnerability could result in total system compromise, including the execution of arbitrary code with the privileges of the user running the application. Given the CVSS score of 7.8, this represents a significant risk to the confidentiality, integrity, and availability of data processed by applications utilizing the affected SDK.

Immediate Action: Update the Autodesk FBX SDK to version 2020.3.10 or later as recommended by the vendor security advisory.

Proactive Monitoring: Monitor systems for anomalous application crashes or unexpected memory usage patterns within software that processes FBX files.

Compensating Controls: Implement strict file validation policies and restrict the processing of untrusted FBX files from unknown or unverified sources.

Public Exploit Available: Unknown.

Organizations utilizing the Autodesk FBX SDK must prioritize the transition to version 2020.3.10. Given the potential for arbitrary code execution, patching should be scheduled as a high priority to minimize the exposure window.