CVE-2026-0661
Published: 04 February 2026
Summary
CVE-2026-0661 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Autodesk 3Ds Max. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 0.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Prompt application of the vendor patch from Autodesk advisory ADSK-SA-2026-0002 directly remediates the memory corruption vulnerability in RGB file parsing.
Memory protection safeguards such as ASLR and DEP directly mitigate memory corruption exploits like CWE-787 out-of-bounds writes leading to arbitrary code execution.
Information input validation at file parsing entry points prevents maliciously crafted RGB files from triggering memory corruption in Autodesk 3ds Max.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Memory corruption in client app (3ds Max) via malicious RGB file enables client-side RCE (T1203) after user opens file (T1204.002).
NVD Description
A maliciously crafted RGB file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Deeper analysisAI
CVE-2026-0661 is a memory corruption vulnerability (CWE-787) affecting Autodesk 3ds Max. The issue arises when the software parses a maliciously crafted RGB file, which can force memory corruption and enable a malicious actor to execute arbitrary code in the context of the current process. Published on 2026-02-04, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
The vulnerability can be exploited by an attacker with local access who tricks a user into opening the malicious RGB file within Autodesk 3ds Max. No special privileges are required, and the attack has low complexity but demands user interaction. Successful exploitation allows arbitrary code execution, resulting in high impacts to confidentiality, integrity, and availability within the user's process context.
Autodesk has issued security advisory ADSK-SA-2026-0002 addressing CVE-2026-0661. Additional information is available at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0002.
Details
- CWE(s)