CVE-2026-0662
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code by tricking users into opening malicious project directories in Autodesk 3ds Max. The attack exploits an untrusted search path issue where the application loads libraries from user-controlled locations. Users of Autodesk 3ds Max who open files from untrusted sources are affected.
💻 Affected Systems
- Autodesk 3ds Max
📦 What is this software?
3ds Max by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the 3ds Max process, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation or malware installation on the user's workstation when opening malicious project files from untrusted sources.
If Mitigated
Limited impact if users only open files from trusted sources and proper application sandboxing is implemented.
🎯 Exploit Status
Requires social engineering to get user to open malicious project directory
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in provided references
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0002
Restart Required: Yes
Instructions:
1. Open Autodesk Access or Autodesk Desktop App
2. Check for available updates
3. Install the latest security update for 3ds Max
4. Restart 3ds Max after installation
🔧 Temporary Workarounds
Restrict project file sources
allOnly open 3ds Max project files from trusted, verified sources
Run with reduced privileges
windowsRun 3ds Max with standard user privileges instead of administrator rights
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized code execution
- Use endpoint detection and response (EDR) solutions to monitor for suspicious process behavior
🔍 How to Verify
Check if Vulnerable:
Check if running a vulnerable version of 3ds Max by comparing version against patched releases in vendor advisoryCheck Version:
In 3ds Max: Help → About 3ds MaxVerify Fix Applied:
Verify 3ds Max version is updated to patched version specified in Autodesk advisory📡 Detection & Monitoring
Log Indicators:
- Unusual process spawning from 3ds Max executable
- DLL loading from unusual directories
Network Indicators:
- Unexpected outbound connections from 3ds Max process
SIEM Query:
Process creation where parent process contains '3dsmax.exe' AND (command line contains suspicious parameters OR image path contains user directories)