CVE-2026-7450: Autodesk 3ds Max DOS Vulnerability

CVE-2026-7450 Overview

CVE-2026-7450 is a NULL pointer dereference vulnerability [CWE-476] in Autodesk 3ds Max. The flaw occurs when the application parses a maliciously crafted PAR file. Successful exploitation crashes the application, producing a denial-of-service condition on the affected workstation.

The vulnerability requires local access and user interaction. An attacker must convince a user to open a crafted PAR file in 3ds Max. Confidentiality and integrity remain intact, but availability is fully impacted on the target host.

Critical Impact

A crafted PAR file processed by Autodesk 3ds Max 2026 or 2027 triggers a NULL pointer dereference that terminates the application, disrupting active modeling and rendering sessions.

Affected Products

• Autodesk 3ds Max 2026
• Autodesk 3ds Max 2027
• File parser component handling PAR file format

Discovery Timeline

• 2026-05-26 - CVE-2026-7450 published to NVD
• 2026-05-26 - Autodesk publishes security advisory ADSK-SA-2026-0006
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-7450

Vulnerability Analysis

The vulnerability is classified as a NULL Pointer Dereference [CWE-476]. The 3ds Max PAR file parser dereferences a pointer without validating that it references a valid object. When the parser encounters a malformed structure inside the PAR file, the pointer remains null, and the subsequent memory access causes an access violation.

The access violation terminates the 3ds Max process. Users lose unsaved work in open scenes, and any running batch render or automation halts. Because the bug resides in file parsing logic, the crash occurs before the user can interact with the loaded data.

The vulnerability does not permit code execution, memory disclosure, or privilege escalation. Impact is restricted to availability of the 3ds Max process on the local workstation.

Root Cause

The parser omits a null check after allocating or resolving an internal object referenced by fields within the PAR file. Crafted field values cause the allocation or lookup to return null, and the parser then accesses members of that null object. The defect is consistent with CWE-476: NULL Pointer Dereference.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious PAR file through email, shared project repositories, asset marketplaces, or removable media. The victim opens or imports the file in 3ds Max 2026 or 2027, and the application crashes during parsing.

No authentication or elevated privileges are required from the attacker. The attack relies entirely on tricking a legitimate user into processing the crafted file. Refer to the Autodesk Security Advisory ADSK-SA-2026-0006 for vendor-supplied technical details.

Detection Methods for CVE-2026-7450

Indicators of Compromise

• Unexpected 3dsmax.exe process termination immediately after opening or importing a PAR file
• Windows Application event log entries containing access violation (0xC0000005) faults referencing 3dsmax.exe
• PAR files received from untrusted email senders, external collaborators, or unverified asset sources
• Repeated 3ds Max crashes correlated to a specific PAR asset across multiple workstations

Detection Strategies

• Monitor for repeated crashes of 3dsmax.exe using endpoint telemetry and Windows Error Reporting data
• Hunt for PAR file deliveries via email gateways and file-sharing platforms, especially from external domains
• Correlate file-open events in 3ds Max with subsequent process exit codes indicating abnormal termination
• Track PAR file hashes that consistently cause crashes and add them to local block lists

Monitoring Recommendations

• Forward Windows Application and Reliability logs from artist workstations to a central SIEM
• Alert on 3dsmax.exe crash events occurring within 60 seconds of a PAR file write or open operation
• Review user-reported crash tickets for patterns involving specific files or project shares

How to Mitigate CVE-2026-7450

Immediate Actions Required

• Apply the patched Autodesk 3ds Max release referenced in Autodesk Security Advisory ADSK-SA-2026-0006
• Instruct artists and engineers to refuse PAR files originating from untrusted or unverified sources
• Enable automatic update delivery through Autodesk Access on all 3ds Max workstations
• Save scenes frequently and enable auto-backup to limit work loss from any crash-based DoS condition

Patch Information

Autodesk has issued fixed builds for 3ds Max 2026 and 2027. Consult Autodesk Security Advisory ADSK-SA-2026-0006 for the exact patched version numbers and download instructions. Deploy the updates through Autodesk Access or your organization's software distribution platform.

Workarounds

• Restrict PAR file imports to assets sourced from trusted internal pipelines until the patch is deployed
• Scan inbound PAR files in an isolated sandbox before distributing them to production workstations
• Apply application-layer controls to block PAR attachments at email gateways pending remediation

# Example PowerShell check for installed 3ds Max version on Windows workstations
Get-ItemProperty 'HKLM:\SOFTWARE\Autodesk\3dsMax\*' |
    Select-Object ProductName, ProductVersion, InstallDir