Cyber Posture

CVE-2026-0537

High

Published: 04 February 2026

Published
04 February 2026
Modified
06 February 2026
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0001 0.9th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-0537 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Autodesk 3Ds Max. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 0.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Requires timely remediation of flaws such as CVE-2026-0537 through patching Autodesk 3ds Max to eliminate the memory corruption vulnerability.

prevent

Implements memory protection mechanisms like ASLR and DEP to prevent arbitrary code execution from memory corruption triggered by malicious RGB files.

prevent

Mandates validation of information inputs, including RGB files parsed by Autodesk 3ds Max, to block malformed data causing memory corruption.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

Memory corruption in file parser enables arbitrary code execution on client via malicious RGB file (T1203 Exploitation for Client Execution + T1204.002 Malicious File).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A maliciously crafted RGB file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

Deeper analysisAI

CVE-2026-0537 is a memory corruption vulnerability (CWE-787) affecting Autodesk 3ds Max. The issue arises when the software parses a maliciously crafted RGB file, which can force memory corruption and enable a malicious actor to execute arbitrary code in the context of the current process. Published on 2026-02-04, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H).

Local attackers can exploit this vulnerability by convincing a user to open a specially crafted RGB file in Autodesk 3ds Max. No privileges are required, though the attack demands low complexity and user interaction. Successful exploitation allows arbitrary code execution with high impacts on confidentiality, integrity, and availability within the application's process context.

Autodesk has issued security advisory ADSK-SA-2026-0002 addressing CVE-2026-0537. Further details are available via the advisory at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0002 and the Autodesk Access product page at https://www.autodesk.com/products/autodesk-access/overview.

Details

CWE(s)

Affected Products

autodesk
3ds max
2026 — 2026.3.2

CVEs Like This One

CVE-2026-0661Same product: Autodesk 3Ds Max
CVE-2026-0536Same product: Autodesk 3Ds Max
CVE-2026-0538Same product: Autodesk 3Ds Max
CVE-2026-0660Same product: Autodesk 3Ds Max
CVE-2026-0662Same product: Autodesk 3Ds Max
CVE-2026-0874Same product: Autodesk 3Ds Max
CVE-2026-0875Same product: Autodesk 3Ds Max
CVE-2025-1430Same vendor: Autodesk
CVE-2025-1429Same vendor: Autodesk
CVE-2025-1433Same vendor: Autodesk

References