Cyber Posture

CVE-2026-0661

High

Published: 04 February 2026

Published
04 February 2026
Modified
06 February 2026
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0001 0.9th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-0661 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Autodesk 3Ds Max. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 0.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Prompt application of the vendor patch from Autodesk advisory ADSK-SA-2026-0002 directly remediates the memory corruption vulnerability in RGB file parsing.

prevent

Memory protection safeguards such as ASLR and DEP directly mitigate memory corruption exploits like CWE-787 out-of-bounds writes leading to arbitrary code execution.

prevent

Information input validation at file parsing entry points prevents maliciously crafted RGB files from triggering memory corruption in Autodesk 3ds Max.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

Memory corruption in client app (3ds Max) via malicious RGB file enables client-side RCE (T1203) after user opens file (T1204.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A maliciously crafted RGB file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

Deeper analysisAI

CVE-2026-0661 is a memory corruption vulnerability (CWE-787) affecting Autodesk 3ds Max. The issue arises when the software parses a maliciously crafted RGB file, which can force memory corruption and enable a malicious actor to execute arbitrary code in the context of the current process. Published on 2026-02-04, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

The vulnerability can be exploited by an attacker with local access who tricks a user into opening the malicious RGB file within Autodesk 3ds Max. No special privileges are required, and the attack has low complexity but demands user interaction. Successful exploitation allows arbitrary code execution, resulting in high impacts to confidentiality, integrity, and availability within the user's process context.

Autodesk has issued security advisory ADSK-SA-2026-0002 addressing CVE-2026-0661. Additional information is available at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0002.

Details

CWE(s)

Affected Products

autodesk
3ds max
2026 — 2026.3.2

CVEs Like This One

CVE-2026-0537Same product: Autodesk 3Ds Max
CVE-2026-0536Same product: Autodesk 3Ds Max
CVE-2026-0538Same product: Autodesk 3Ds Max
CVE-2026-0660Same product: Autodesk 3Ds Max
CVE-2026-0662Same product: Autodesk 3Ds Max
CVE-2026-0874Same product: Autodesk 3Ds Max
CVE-2026-0875Same product: Autodesk 3Ds Max
CVE-2025-1430Same vendor: Autodesk
CVE-2025-1429Same vendor: Autodesk
CVE-2025-1433Same vendor: Autodesk

References