CVE-2026-0537
Published: 04 February 2026
Summary
CVE-2026-0537 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Autodesk 3Ds Max. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 0.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of flaws such as CVE-2026-0537 through patching Autodesk 3ds Max to eliminate the memory corruption vulnerability.
Implements memory protection mechanisms like ASLR and DEP to prevent arbitrary code execution from memory corruption triggered by malicious RGB files.
Mandates validation of information inputs, including RGB files parsed by Autodesk 3ds Max, to block malformed data causing memory corruption.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Memory corruption in file parser enables arbitrary code execution on client via malicious RGB file (T1203 Exploitation for Client Execution + T1204.002 Malicious File).
NVD Description
A maliciously crafted RGB file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Deeper analysisAI
CVE-2026-0537 is a memory corruption vulnerability (CWE-787) affecting Autodesk 3ds Max. The issue arises when the software parses a maliciously crafted RGB file, which can force memory corruption and enable a malicious actor to execute arbitrary code in the context of the current process. Published on 2026-02-04, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H).
Local attackers can exploit this vulnerability by convincing a user to open a specially crafted RGB file in Autodesk 3ds Max. No privileges are required, though the attack demands low complexity and user interaction. Successful exploitation allows arbitrary code execution with high impacts on confidentiality, integrity, and availability within the application's process context.
Autodesk has issued security advisory ADSK-SA-2026-0002 addressing CVE-2026-0537. Further details are available via the advisory at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0002 and the Autodesk Access product page at https://www.autodesk.com/products/autodesk-access/overview.
Details
- CWE(s)