Read the docs
TI-2026-00456 Aliases CVE-2026-0662GHSA-j98v-582h-h35h

Untrusted Search Path Vulnerability when opening max Files

Priority LOW 35CWE-426Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-426.

Summary

A maliciously crafted project directory, when opening a max file in Autodesk 3ds Max, could lead to execution of arbitrary code in the context of the current process due to an Untrusted Search Path being utilized.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00204 10th percentileScored 2026-11-07
Fix Fixed 3ds Max (Autodesk): 2026.3.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Autodesk3ds Max2026 to before 2026.3.22026.3.2Patch availableCNA
  • 3ds Max VendorAutodesk Affected 2026 to before 2026.3.2 Fixed in 2026.3.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:autodesk:3ds_max:*:*:*:*:*:*:*:*2026 to before 2026.3.2VulnerableAutodesk
  • cpe:2.3:a:autodesk:3ds_max:*:*:*:*:*:*:*:* Versions 2026 to before 2026.3.2 Vulnerable ·Autodesk

Remediation

  • Fix · CNA 3ds Max (Autodesk) Fixed in 2026.3.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Autodesk 3ds Max — autodesk.com/trust/security-advisories/adsk-sa-2026-0002

    6 records Highest priority Priority LOW 6 LOW

    Other records, highest priority first

    • TI-2026-00455 Out-of-Bounds Write in RGB File ParsingPriority LOW 38
    • TI-2026-00454 Stack Based Buffer Overflow in GIF File ParsingPriority LOW 38
    • TI-2026-00341 GIF File Parsing Out-of-Bounds WritePriority LOW 38
    Show all 6 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-0662
  2. 2026-10-03 Alias added: GHSA-j98v-582h-h35h

References

Patch 1

Advisory 1

  • TI-2009-03414 Autodesk 3D Studio Max (3DSMax) 6 through 9 and 2008 through 2010 allows remote attackers… CVSS 2.0HIGH 9.3
  • TI-2026-00455 Out-of-Bounds Write in RGB File Parsing CVSS 3.1HIGH 8.4
  • TI-2026-00454 Stack Based Buffer Overflow in GIF File Parsing CVSS 3.1HIGH 8.4
  • TI-2026-00341 GIF File Parsing Out-of-Bounds Write CVSS 3.1HIGH 8.4
  • TI-2026-00340 RGB File Parsing Memory Corruption CVSS 3.1HIGH 8.4
  • TI-2025-06023 TGA File Parsing Memory Corruption Vulnerability CVSS 3.1HIGH 7.8
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences