This vulnerability (CVE-2026-0537) in Autodesk 3ds Max 2026 is caused by improper handling of RGB files, leading to an out-of-bounds write (CWE-787). When a specially crafted RGB file is parsed, it triggers memory corruption that can be exploited to execute arbitrary code in the context of the 3ds Max process. The CVSS 3.1 vector indicates local attack vector with low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to execute arbitrary code within the Autodesk 3ds Max process, potentially leading to full compromise of the affected application. This can result in unauthorized data access, modification, or denial of service. The vulnerability does not require privileges or user interaction, increasing its risk in local attack scenarios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid opening untrusted RGB files with Autodesk 3ds Max 2026. Monitor Autodesk's security advisories for updates on patches or mitigations.