Cyber Resilience

CVE-2026-0537

HighUpdated

Published: 04 February 2026

Published
04 February 2026
Modified
03 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0017 6.8th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-0537 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Autodesk 3Ds Max. Its CVSS base score is 8.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 6.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2026-0537 is a memory corruption vulnerability (CWE-787) affecting Autodesk 3ds Max. The issue arises when the software parses a maliciously crafted RGB file, which can force memory corruption and enable a malicious actor to execute arbitrary code in the context of the current process. Published on 2026-02-04, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H).

Local attackers can exploit this vulnerability by convincing a user to open a specially crafted RGB file in Autodesk 3ds Max. No privileges are required, though the attack demands low complexity and user interaction. Successful exploitation allows arbitrary code execution with high impacts on confidentiality, integrity, and availability within the application's process context.

Autodesk has issued security advisory ADSK-SA-2026-0002 addressing CVE-2026-0537. Further details are available via the advisory at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0002 and the Autodesk Access product page at https://www.autodesk.com/products/autodesk-access/overview.

EU & UK References

Vulnerability details

A maliciously crafted RGB file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

CWE(s)
CWE-787

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
attack.mitre.org →
Why these techniques?

Memory corruption in file parser enables arbitrary code execution on client via malicious RGB file (T1203 Exploitation for Client Execution + T1204.002 Malicious File).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-0536Same product: Autodesk 3Ds Max
CVE-2026-0661Same product: Autodesk 3Ds Max
CVE-2026-0538Same product: Autodesk 3Ds Max
CVE-2026-7451Same product: Autodesk 3Ds Max
CVE-2026-0660Same product: Autodesk 3Ds Max
CVE-2026-7452Same product: Autodesk 3Ds Max
CVE-2026-7454Same product: Autodesk 3Ds Max
CVE-2026-0662Same product: Autodesk 3Ds Max
CVE-2026-0874Same product: Autodesk 3Ds Max
CVE-2026-0875Same product: Autodesk 3Ds Max

Affected Assets

autodesk
3ds max
2026 — 2026.3.2

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Requires timely remediation of flaws such as CVE-2026-0537 through patching Autodesk 3ds Max to eliminate the memory corruption vulnerability.

SI-16 Memory Protection good match
prevent

Implements memory protection mechanisms like ASLR and DEP to prevent arbitrary code execution from memory corruption triggered by malicious RGB files.

SI-10 Information Input Validation good match
prevent

Mandates validation of information inputs, including RGB files parsed by Autodesk 3ds Max, to block malformed data causing memory corruption.

References