CVE-2026-16782: CWE-125 Out-of-Bounds Read in Autodesk 3ds Max

This vulnerability (CWE-125) arises when Autodesk 3ds Max improperly handles certain SVG files, leading to an Out-of-Bounds Read condition. An attacker can exploit this flaw by supplying a specially crafted SVG file to the software, which may result in a crash, unauthorized data disclosure, or execution of arbitrary code under the current process privileges. The affected versions include 2026.0.0, 2027.0.0, and ranges from 2026.0.0 up to but not including 2026.3.4, and 2027.0.0 up to but not including 2027.2.0. No known exploits are reported in the wild, and no official patch or remediation details are provided in the source data.

Successful exploitation can lead to application crashes, potential leakage of sensitive information, and possibly arbitrary code execution within the context of the 3ds Max process. This could compromise the confidentiality and stability of the affected system. However, the CVSS vector indicates no integrity or availability impact, and no privileges or user interaction are required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid opening untrusted SVG files in Autodesk 3ds Max. Monitor Autodesk's official channels for updates or patches addressing this vulnerability.