Threat database

CVE-2026-10710 is a high-severity stack-based buffer overflow vulnerability in Autodesk FBX SDK version 2020.3.9. It occurs in the function fbxsdk::ExtractDrive when parsing a maliciously crafted FBX file. Successful exploitation could allow an attacker to execute arbitrary code within the context of the affected process. The vulnerability requires local access with user interaction and has low attack complexity. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-10709 is a stack-based buffer overflow vulnerability in Autodesk FBX SDK version 2020.3.9. It occurs in the function fbxsdk::FbxIO::BinaryReadSectionHeader when parsing a maliciously crafted FBX file. Successful exploitation can allow arbitrary code execution within the context of the current process. The vulnerability has a high severity score of 7.8 and requires local access with user interaction to trigger.

A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information.

A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information.

A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user.

A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.

CVE-2026-7454 is a high-severity buffer overflow vulnerability in Autodesk 3ds Max versions 2026 and 2027. It arises from improper handling of WRL files, where a maliciously crafted file can cause memory corruption. This vulnerability allows an attacker to execute arbitrary code within the context of the affected process, potentially leading to full compromise of the application. The vulnerability requires local access with user interaction to trigger. No official patch or remediation guidance has been confirmed yet.

A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can cause a Stack Exhaustion vulnerability, leading to a denial-of-service condition.

CVE-2026-7452 is a high-severity buffer overflow vulnerability in Autodesk 3ds Max versions 2026 and 2027. It arises from improper handling of WRL files, allowing a maliciously crafted file to cause memory corruption. This can enable an attacker to execute arbitrary code within the context of the affected process. The vulnerability requires local access with user interaction to trigger. No official patch or remediation guidance has been confirmed at this time.

CVE-2026-7451 is an out-of-bounds write vulnerability in Autodesk 3ds Max versions 2026 and 2027 triggered by parsing a maliciously crafted TIF file. Exploitation can lead to application crashes, data corruption, or arbitrary code execution within the context of the affected process. The vulnerability has a high severity rating with a CVSS score of 7.8. No official patch or remediation guidance has been provided by Autodesk as of the publication date. There are no known exploits in the wild at this time.

A maliciously crafted PAR file, when parsed through Autodesk 3ds Max, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.

A maliciously crafted HTML payload in a component name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

A maliciously crafted HTML payload, stored in a design name and exported to CSV, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

A maliciously crafted HTML payload in an assembly variant name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can cause a Stack-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

A maliciously crafted project directory, when opening a max file in Autodesk 3ds Max, could lead to execution of arbitrary code in the context of the current process due to an Untrusted Search Path being utilized.