CVE-2026-0662: Autodesk 3ds Max RCE Vulnerability

CVE-2026-0662 Overview

A maliciously crafted project directory, when opening a max file in Autodesk 3ds Max, could lead to execution of arbitrary code in the context of the current process due to an Untrusted Search Path being utilized. This vulnerability (CWE-426) allows attackers to place malicious DLL files in project directories that will be loaded and executed when users open seemingly legitimate 3ds Max project files.

Critical Impact

Successful exploitation allows attackers to execute arbitrary code with the privileges of the current user, potentially leading to complete system compromise, data theft, or lateral movement within an organization.

Affected Products

• Autodesk 3ds Max (specific versions detailed in ADSK-SA-2026-0002)

Discovery Timeline

• 2026-02-04 - CVE-2026-0662 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-0662

Vulnerability Analysis

This vulnerability falls under the category of Untrusted Search Path (CWE-426), a type of security flaw where an application searches for external resources such as libraries or executables in directories that may be under attacker control. When Autodesk 3ds Max opens a .max project file, the application searches for required DLL files in specific paths, including the project directory itself. An attacker can exploit this behavior by placing a malicious DLL with an expected filename in the same directory as a legitimate project file.

The local attack vector requires user interaction—specifically, the victim must open a malicious project file. This could occur through various social engineering scenarios, such as receiving project files from untrusted sources, downloading projects from compromised file-sharing platforms, or working with shared network directories where an attacker has planted malicious content.

Root Cause

The root cause of this vulnerability is improper handling of the DLL search order in Autodesk 3ds Max. The application fails to properly validate or restrict the search paths used when loading dynamic libraries, allowing the current working directory (project directory) to take precedence over secure system directories. This design flaw enables DLL hijacking attacks where malicious libraries are loaded instead of legitimate system components.

Attack Vector

The attack requires local access, meaning the attacker must be able to place malicious files on the target system or convince the user to download a compromised project archive. A typical attack scenario involves:

1. An attacker creates a legitimate-looking 3ds Max project archive
2. A malicious DLL is included in the project directory with a filename that matches a library the application attempts to load
3. The victim extracts and opens the project file
4. Autodesk 3ds Max searches for required DLLs and finds the malicious library in the project directory
5. The malicious DLL is loaded and executed in the context of the 3ds Max process

This attack does not require any elevated privileges from the attacker, but successful exploitation provides code execution with the full privileges of the user running 3ds Max. For users with administrative privileges, this could result in complete system compromise.

Detection Methods for CVE-2026-0662

Indicators of Compromise

• Unexpected DLL files present in 3ds Max project directories that do not belong to the standard project structure
• DLL files with names matching common Windows system libraries located alongside .max project files
• Process execution anomalies where 3ds Max spawns unexpected child processes or network connections
• File system events showing DLL loads from user-writable project directories rather than standard installation paths

Detection Strategies

• Monitor DLL loading behavior of 3dsmax.exe processes using endpoint detection tools to identify libraries loaded from non-standard paths
• Implement file integrity monitoring on 3ds Max project directories to detect insertion of suspicious DLL files
• Configure application whitelisting policies to prevent unsigned or unexpected DLLs from loading within the 3ds Max process context
• Deploy SentinelOne agents with behavioral AI to detect anomalous code execution patterns associated with DLL hijacking attacks

Monitoring Recommendations

• Enable detailed process auditing to track DLL loads and identify unexpected library sources
• Configure alerts for any executable or DLL creation events within directories commonly used for 3ds Max projects
• Implement network monitoring to detect any outbound connections initiated by 3ds Max that deviate from normal application behavior
• Review endpoint telemetry for any process injection or code execution techniques following 3ds Max file opens

How to Mitigate CVE-2026-0662

Immediate Actions Required

• Review and apply the security patch from Autodesk as detailed in Autodesk Security Advisory ADSK-SA-2026-0002
• Avoid opening 3ds Max project files from untrusted or unverified sources until patching is complete
• Scan any received project archives for suspicious DLL files before opening in 3ds Max
• Ensure endpoint protection solutions are updated to detect DLL hijacking attack patterns

Patch Information

Autodesk has released security updates to address this vulnerability. Organizations should consult the Autodesk Security Advisory ADSK-SA-2026-0002 for specific patch versions and installation instructions. It is recommended to update Autodesk 3ds Max to the latest available version through the standard update mechanism or by downloading the patched installer from the Autodesk portal.

Workarounds

• Configure Windows DLL search order hardening via the SafeDllSearchMode registry setting to prioritize system directories over the current working directory
• Implement organizational policies requiring verification of project files before opening, including scanning for unexpected executable content
• Use application sandboxing or virtualization when working with project files from external or untrusted sources
• Restrict network access for 3ds Max processes to limit the impact of successful exploitation

# Windows registry hardening for DLL search order
# Run as Administrator in Command Prompt
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v SafeDllSearchMode /t REG_DWORD /d 1 /f