CVE-2026-7454
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability, allowing arbitrary code execution in the context of the current process.
Risk Assessment
Opening a malicious WRL file may lead to system compromise by an attacker.
Recommendation
Do not open WRL files from untrusted sources. Update Autodesk 3ds Max to the latest version if a patch is available.
Other vulnerabilities in Autodesk 3ds Max
See all- CVE-2026-7455High
A maliciously crafted FLT file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
- CVE-2026-19568High
A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. An attacker can leverage this to execute arbitrary code in the context of the current process.
- CVE-2026-16783High
A maliciously crafted ABC file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. An attacker may leverage this to cause a crash, data corruption, or arbitrary code execution in the context of the current process.
- CVE-2026-16782Medium
A maliciously crafted SVG file parsed through Autodesk 3ds Max can cause an Out-of-Bounds Read vulnerability, allowing a crash, sensitive data read, or arbitrary code execution in the current process context.
- CVE-2026-16781Medium
A maliciously crafted SVG file parsed through Autodesk 3ds Max can trigger uncontrolled recursion. An attacker may exploit this to cause the application to terminate unexpectedly, resulting in denial of service.
- CVE-2026-7453Medium
A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can cause a Stack Exhaustion vulnerability, leading to a denial-of-service condition.
- CVE-2026-7452High
A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a memory corruption vulnerability. An attacker can leverage this to execute arbitrary code in the current process context.
- CVE-2026-7451High
A maliciously crafted TIF file, when parsed through Autodesk 3ds Max, can force an out-of-bounds write vulnerability. An attacker may leverage this to cause a crash, data corruption, or arbitrary code execution.
- CVE-2026-7450Medium
A maliciously crafted PAR file, when parsed through Autodesk 3ds Max, can force a NULL Pointer Dereference vulnerability, causing the application to crash and leading to a denial-of-service condition.
Original NVD description (English source)
A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.