3ds Max — CraftedSignal Threat Feed

Autodesk 3ds Max Memory Corruption Vulnerability via Malformed WRL File (CVE-2026-7452)

hello@craftedsignal.io — Tue, 26 May 2026 18:24:12 +0000

CVE-2026-7452 describes a memory corruption vulnerability within Autodesk 3ds Max when parsing maliciously crafted WRL files. An attacker can exploit this vulnerability by enticing a user to open a specially crafted WRL file using Autodesk 3ds Max. Successful exploitation leads to arbitrary code execution within the security context of the 3ds Max process. This vulnerability could be leveraged to install malware, pivot to other systems, or exfiltrate sensitive data. Given the widespread use of 3ds Max in various industries, this vulnerability poses a significant threat to organizations using the software.

Attack Chain

Attacker crafts a malicious WRL file designed to trigger a memory corruption error in Autodesk 3ds Max.
The attacker delivers the malicious WRL file to a target user through various methods (e.g., email, shared drive, website).
The user, unaware of the threat, opens the WRL file using Autodesk 3ds Max.
3ds Max attempts to parse the malformed WRL file, leading to a buffer overflow or other memory corruption error.
The memory corruption vulnerability is triggered, allowing the attacker to overwrite critical parts of the process memory.
The attacker injects malicious code into the 3ds Max process memory.
The injected code executes within the context of the 3ds Max process.
The attacker gains control of the system, potentially installing malware or performing other malicious activities.

Impact

Successful exploitation of CVE-2026-7452 allows an attacker to execute arbitrary code within the context of the Autodesk 3ds Max process. This could lead to complete system compromise, data theft, or the deployment of ransomware. Organizations in industries heavily reliant on 3D modeling and design, such as architecture, engineering, and media, are particularly at risk. The impact could range from loss of intellectual property to significant financial losses and reputational damage.

Recommendation

Apply the security patch released by Autodesk to address CVE-2026-7452 in 3ds Max immediately (reference: https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0006).
Implement user awareness training to educate users about the risks of opening files from untrusted sources.
Deploy the Sigma rule “Detect Suspicious 3ds Max Process Creation with WRL File” to identify potential exploitation attempts (reference: Sigma rule below).
Monitor process creation events for 3ds Max spawning unusual child processes, which could indicate successful code execution (reference: Sigma rule below).
Enable file integrity monitoring for Autodesk 3ds Max installation directory to detect unauthorized modifications.

CVE-2026-7454 — Autodesk 3ds Max Memory Corruption Vulnerability via Malicious WRL File

hello@craftedsignal.io — Tue, 26 May 2026 18:19:06 +0000

CVE-2026-7454 is a memory corruption vulnerability affecting Autodesk 3ds Max. The vulnerability is triggered when the software parses a maliciously crafted WRL (VRML) file. Successful exploitation could allow an attacker to execute arbitrary code within the context of the 3ds Max process. The vulnerability stems from a buffer overflow (CWE-120) during the parsing of the WRL file. An attacker would need to entice a user to open a malicious WRL file within 3ds Max to trigger the vulnerability. This could lead to complete system compromise.

Attack Chain

Attacker crafts a malicious WRL file designed to trigger a buffer overflow.
Attacker delivers the malicious WRL file to a target user, likely via social engineering.
The user opens the malicious WRL file in Autodesk 3ds Max.
3ds Max attempts to parse the WRL file.
The crafted WRL file exploits a buffer overflow vulnerability (CVE-2026-7454) during the parsing process.
The overflow overwrites memory, potentially including instruction pointers or other critical data.
The attacker gains control of the execution flow.
The attacker executes arbitrary code within the context of the 3ds Max process.

Impact

Successful exploitation of CVE-2026-7454 allows for arbitrary code execution. An attacker can leverage this vulnerability to install malware, steal sensitive data, or perform other malicious actions on the affected system. The severity is high, with a CVSS v3.1 score of 7.8, indicating significant potential for system compromise. The impact is limited to systems where Autodesk 3ds Max is installed and used to open untrusted WRL files.

Recommendation

Apply the security update provided by Autodesk to patch CVE-2026-7454; refer to the Autodesk security advisory https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0006.
Deploy the Sigma rule “Detect Suspicious 3ds Max Process Creation” to detect potential exploitation attempts based on abnormal 3ds Max behavior.
Educate users about the risks of opening untrusted files, especially WRL files in Autodesk 3ds Max.

CVE-2026-7451 - Autodesk 3ds Max Out-of-Bounds Write Vulnerability via Malicious TIF File

hello@craftedsignal.io — Tue, 26 May 2026 18:18:40 +0000

CVE-2026-7451 is an out-of-bounds write vulnerability affecting Autodesk 3ds Max. The vulnerability arises when the software parses a maliciously crafted TIF file. Successful exploitation could lead to a crash, data corruption, or even arbitrary code execution within the context of the current process. This vulnerability poses a significant risk to users who process untrusted TIF files with Autodesk 3ds Max. An attacker could potentially leverage this vulnerability to compromise a system by enticing a user to open a malicious TIF file.

Attack Chain

Attacker crafts a malicious TIF file designed to trigger the out-of-bounds write.
Attacker delivers the malicious TIF file to a target user (e.g., via email, shared drive, or website).
The user opens the malicious TIF file using Autodesk 3ds Max.
Autodesk 3ds Max parses the TIF file, triggering the out-of-bounds write vulnerability due to the malicious content.
The out-of-bounds write corrupts memory within the 3ds Max process.
The memory corruption leads to a crash, data corruption, or enables arbitrary code execution.
If arbitrary code execution is achieved, the attacker can gain control of the affected system.
The attacker can then perform malicious activities such as installing malware, stealing data, or further compromising the network.

Impact

Successful exploitation of CVE-2026-7451 can lead to several negative consequences. A crash can cause loss of unsaved work and disrupt productivity. Data corruption can result in loss of valuable assets and require costly recovery efforts. Arbitrary code execution allows an attacker to gain complete control over the affected system, leading to data theft, malware installation, or further network compromise. Given the potential for arbitrary code execution, this vulnerability is considered high severity.

Recommendation

Apply the security update provided by Autodesk to patch CVE-2026-7451 in Autodesk 3ds Max.
Educate users about the risks of opening files from untrusted sources to prevent social engineering attacks.
Monitor for unexpected crashes or unusual behavior in Autodesk 3ds Max processes that could indicate exploitation attempts.
Deploy the Sigma rule to detect suspicious process creation events related to 3ds Max after loading potentially malicious files.