A Stack-based Buffer Overflow Vulnerability in Autodesk 3ds Max 2022, 2021, and 2020 may…
Priority LOW 34CWE-1284Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A Stack-based Buffer Overflow Vulnerability in Autodesk 3ds Max 2022, 2021, and 2020 may lead to code execution through the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer when parsing ActionScript Byte Code files. This vulnerability may allow arbitrary code execution on affected installations of Autodesk 3ds Max.
Why it matters now
EPSS 0.00386 32nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Autodesk 3ds Max | Autodesk 3ds Max 2022, 2021, 2020 | — | No fix listed | CNA |
- Autodesk 3ds Max Vendor— Affected Autodesk 3ds Max 2022, 2021, 2020 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:autodesk:3ds_max:*:*:*:*:*:*:*:* | 2020 to before 2020.3.6; 2021 to before 2021.3.10; 2022 – 2022.3.3 | Vulnerable | Autodesk |
- cpe:2.3:a:autodesk:3ds_max:*:*:*:*:*:*:*:* Versions 2020 to before 2020.3.6; 2021 to before 2021.3.10; 2022 – 2022.3.3 Vulnerable ·Autodesk
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-25793
- 2026-10-03 Alias added: GHSA-9rxv-3wjc-q29g
References
More Autodesk 3ds Max vulnerabilities
- TI-2009-03414 Autodesk 3D Studio Max (3DSMax) 6 through 9 and 2008 through 2010 allows remote attackers… CVSS 2.0HIGH 9.3
- TI-2026-00455 Out-of-Bounds Write in RGB File Parsing CVSS 3.1HIGH 8.4
- TI-2026-00454 Stack Based Buffer Overflow in GIF File Parsing CVSS 3.1HIGH 8.4
- TI-2026-00341 GIF File Parsing Out-of-Bounds Write CVSS 3.1HIGH 8.4
- TI-2026-00340 RGB File Parsing Memory Corruption CVSS 3.1HIGH 8.4
- TI-2025-06023 TGA File Parsing Memory Corruption Vulnerability CVSS 3.1HIGH 7.8
Sources
- CVE-2022-25793 · CVE Program
- CVE-2022-25793 · NVD
- FIRST EPSS
- GHSA-9rxv-3wjc-q29g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences