CVE-2026-19568: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Autodesk 3ds Max

This vulnerability (CVE-2026-19568) is a classic buffer overflow (CWE-120) in Autodesk 3ds Max triggered by parsing a malicious SVG file. The flaw causes memory corruption that can be exploited to execute arbitrary code in the context of the current process. The CVSS 3.1 score is 7.8 (high), with attack vector local, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Affected versions explicitly include 2026.0.0 and 2027.0.0. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Exploitation of this vulnerability can lead to arbitrary code execution with the privileges of the user running Autodesk 3ds Max. This can compromise confidentiality, integrity, and availability of the affected system. The attack requires local access and user interaction (opening a crafted SVG file). There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening SVG files from untrusted sources and consider limiting access to Autodesk 3ds Max installations to trusted users only.