This vulnerability (CVE-2026-0661) in Autodesk 3ds Max 2026 involves a CWE-787 out-of-bounds write triggered by processing a specially crafted RGB file. The flaw leads to memory corruption that can be exploited to achieve arbitrary code execution with high impact on confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.4, reflecting local attack vector, low attack complexity, no privileges required, no user interaction, and full impact on system security properties. The vendor has not published a patch or advisory detailing remediation steps as of the published date.

Exploitation of this vulnerability allows an attacker to execute arbitrary code in the context of the current process, potentially leading to full compromise of the affected application. The vulnerability impacts confidentiality, integrity, and availability at a high level. Since the attack vector is local, an attacker must have the ability to supply a malicious RGB file to the application. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid opening untrusted RGB files in Autodesk 3ds Max 2026. Monitor Autodesk's security advisories for updates on patches or mitigations.