CVE-2026-0660
Published: 04 February 2026
Summary
CVE-2026-0660 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Autodesk 3Ds Max. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 8.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-0660 is a stack-based buffer overflow vulnerability (CWE-121) in Autodesk 3ds Max, triggered when the software parses a maliciously crafted GIF file. This flaw affects the GIF parsing component within Autodesk 3ds Max, allowing potential exploitation during file import or processing operations. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H), indicating high impact on confidentiality, integrity, and availability.
An attacker can exploit this vulnerability by convincing a user to open a specially crafted GIF file in Autodesk 3ds Max, requiring local access and user interaction but no special privileges. Successful exploitation enables arbitrary code execution in the context of the current process, potentially leading to full compromise of the affected application and the user's system.
For mitigation details, refer to Autodesk's security advisory ADSK-SA-2026-0002, available at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0002. Additional product information is provided at https://www.autodesk.com/products/autodesk-access/overview.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5410
Vulnerability details
A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can cause a Stack-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in client-side GIF parsing enables RCE via malicious file opened by user (T1203 Exploitation for Client Execution and T1204.002 Malicious File).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the stack-based buffer overflow by requiring timely remediation through vendor patches as specified in Autodesk's security advisory.
Implements memory safeguards like ASLR, DEP, and stack canaries that prevent successful arbitrary code execution from stack-based buffer overflows.
Enforces validation of information inputs such as GIF files to block malformed data that triggers the buffer overflow during parsing.