Autodesk 3ds Max Out-of-Bounds Write Vulnerability (CVE-2026-16783)

Autodesk has disclosed a high-severity vulnerability (CVE-2026-16783) in 3ds Max affecting versions prior to 2027.2.0 and 2026.3.4. The vulnerability is classified as an Out-of-Bounds Write (CWE-787), occurring during the parsing of Alembic (.abc) files.

An attacker can exploit this flaw by providing a specially crafted .abc file to a victim. When the victim opens or imports this file into 3ds Max, the application improperly handles memory, leading to an out-of-bounds write condition. Successful exploitation may result in an application crash, memory corruption, or the execution of arbitrary code within the security context of the user running the 3ds Max process. This vulnerability requires user interaction, typically through the opening of untrusted project assets.

Impact

Successful exploitation of this vulnerability allows an attacker to gain code execution under the context of the user running the application. Given 3ds Max is typically used in professional creative environments, this can lead to lateral movement within the organization or theft of intellectual property. If the process is running with elevated privileges, the impact on the host system could be significant.

Recommendation

• Update Autodesk 3ds Max to version 2027.2.0 or 2026.3.4 or later immediately as per the vendor security advisory adsk-sa-2026-0014.
• Implement strict asset management workflows, ensuring that only Alembic files from trusted sources are imported into 3ds Max projects.
• Monitor for child processes spawned by 3dsmax.exe, as abnormal process trees may indicate exploitation attempts.