CVE-2026-16781: Autodesk 3ds Max SVG Parsing DOS Vulnerability

CVE-2026-16781 Overview

CVE-2026-16781 is an uncontrolled recursion vulnerability [CWE-674] affecting Autodesk 3ds Max. The flaw resides in the application's Scalable Vector Graphics (SVG) parser. A maliciously crafted SVG file, when opened or imported into 3ds Max, triggers unbounded recursion within the parsing logic. The result is an unexpected application termination, producing a denial-of-service condition against the affected workstation.

Exploitation requires local access and user interaction, since a target must open the malicious SVG file. The vulnerability does not permit code execution, data theft, or integrity violations. Autodesk documented the issue in security advisory ADSK-SA-2026-0014.

Critical Impact
A crafted SVG file causes Autodesk 3ds Max to crash through uncontrolled recursion, disrupting artist workflows and any long-running rendering or scene work in progress.

Affected Products

Autodesk 3ds Max (versions listed in Autodesk security advisory ADSK-SA-2026-0014)
Autodesk 3ds Max SVG import and parsing component
Any Autodesk 3ds Max installation processing untrusted SVG assets

Discovery Timeline

2026-08-24 - CVE-2026-16781 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-16781

Vulnerability Analysis

The vulnerability is classified as Uncontrolled Recursion [CWE-674]. Autodesk 3ds Max parses SVG files during import or scene load operations. SVG is an Extensible Markup Language (XML) based format that supports nested elements, references, and structural composition.

When the parser encounters a specially crafted SVG document, the parsing routine recurses without an enforced depth limit or cycle detection. Each recursive call consumes additional stack frames until the thread exhausts its stack space. The process then terminates abnormally, producing a denial-of-service outcome. Because the attacker controls only the input file and never gains execution, impact is limited to availability. Confidentiality and integrity of scene data, credentials, and system state are not affected by this flaw.

Root Cause

The root cause is missing recursion depth enforcement in the SVG parsing component shipped with Autodesk 3ds Max. The parser follows nested SVG constructs without validating a maximum nesting depth or detecting recursive references between elements. Attacker-controlled structure directly drives recursion depth, which allows a small input file to consume the full call stack.

Attack Vector

The attack requires local access and user interaction. An attacker must deliver a malicious SVG file, typically through email attachments, shared project folders, asset marketplaces, or compromised file shares. The target user then opens or imports the SVG into Autodesk 3ds Max. Parsing begins immediately, and the application crashes without any additional attacker action. The vulnerability cannot be triggered remotely without user-initiated file processing. See the Autodesk Security Advisory ADSK-SA-2026-0014 for authoritative technical details.

Detection Methods for CVE-2026-16781

Indicators of Compromise

Unexpected termination of the 3dsmax.exe process shortly after opening or importing an SVG asset.
Windows Error Reporting (WER) or application crash entries citing stack overflow exceptions in the Autodesk 3ds Max process.
SVG files originating from untrusted sources present in artist project directories or shared asset repositories.

Detection Strategies

Monitor for repeated crash events tied to 3dsmax.exe correlated with recent SVG file access in the same user session.
Inspect SVG files for pathological nesting patterns, recursive element references, or abnormal element counts prior to allowing import.
Alert on delivery of SVG files from external email or web sources directly into 3D content pipelines.

Monitoring Recommendations

Collect Windows application crash telemetry and forward stack-fault events for Autodesk processes to your central logging platform.
Track file provenance for SVG assets ingested into artist workstations, including source URL, sender, and hash.
Baseline normal Autodesk 3ds Max session length so that repeated short-lived process instances can be flagged for review.

How to Mitigate CVE-2026-16781

Immediate Actions Required

Apply the fixed version of Autodesk 3ds Max identified in Autodesk Security Advisory ADSK-SA-2026-0014.
Instruct artists and technical directors to avoid opening SVG files received from untrusted or unverified sources.
Quarantine SVG assets sourced from external marketplaces or third-party contributors until they can be validated.

Patch Information

Autodesk has published fixed versions of 3ds Max in advisory ADSK-SA-2026-0014. Refer to the Autodesk security advisory and the Autodesk Access product overview to identify the corrected build for your deployment and to automate updates through Autodesk Access.

Workarounds

Restrict SVG imports in production pipelines to files originating from trusted internal sources only.
Pre-validate SVG files with an external, sandboxed parser that enforces maximum nesting depth before allowing them into 3ds Max.
Run Autodesk 3ds Max under a standard user account so that a crash does not impact system-level services or other users on the workstation.

bash

# Configuration example: block SVG delivery to artist workstations via mail gateway rule
# (illustrative pseudo-configuration for a content filter)
rule "block-untrusted-svg-to-3dsmax-users" {
    match  attachment.extension == "svg"
    match  recipient.group == "3dsmax-artists"
    match  sender.trust_level < "internal"
    action quarantine
    notify security-ops@example.com
}