CVE-2026-10710
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow in fbxsdk::ExtractDrive, allowing arbitrary code execution in the context of the current process.
Risk Assessment
An attacker can exploit this vulnerability for remote code execution, potentially leading to full system compromise.
Recommendation
Update Autodesk FBX SDK to a patched version and avoid parsing untrusted FBX files.
Other vulnerabilities in Autodesk FBX SDK
See all- CVE-2016-9304High
Multiple buffer overflows in Autodesk FBX-SDK before version 2017.1 can allow attackers to execute arbitrary code when reading or converting malformed DFX format files.
- CVE-2016-9307Critical
Multiple buffer overflows in Autodesk FBX-SDK before version 2017.1 can allow attackers to execute arbitrary code when reading or converting malformed 3DS format files.
- CVE-2016-9306Critical
Multiple buffer overflows in Autodesk FBX-SDK before version 2017.1 can allow attackers to execute arbitrary code when reading or converting malformed DAE format files.
- CVE-2016-9305Critical
Improper handling in the Autodesk FBX-SDK before version 2017.1 regarding type mismatches and previously deleted objects related to reading and converting malformed FBX format files can allow attackers to gain access to uninitialized pointers.
- CVE-2016-9303Critical
Multiple buffer overflows in Autodesk FBX-SDK before version 2017.1 can allow attackers to execute arbitrary code or cause an infinite loop condition when reading or converting malformed FBX format files.
- CVE-2026-10709High
A maliciously crafted FBX file parsed through Autodesk FBX SDK can trigger a stack-based buffer overflow in fbxsdk::FbxIO::BinaryReadSectionHeader.
Original NVD description (English source)
A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.