CVE-2026-7452: Autodesk 3ds Max RCE Vulnerability

CVE-2026-7452 Overview

CVE-2026-7452 is a memory corruption vulnerability in Autodesk 3ds Max that triggers when the application parses a maliciously crafted Virtual Reality Modeling Language (WRL) file. The flaw is classified under [CWE-120] (Buffer Copy without Checking Size of Input). An attacker who convinces a user to open a weaponized WRL file can execute arbitrary code in the context of the current 3ds Max process. The vulnerability affects Autodesk 3ds Max 2026 and 2027. Autodesk published advisory ADSK-SA-2026-0006 to document the issue and provide remediation guidance.

Critical Impact

Successful exploitation enables arbitrary code execution under the privileges of the user running 3ds Max, with high impact to confidentiality, integrity, and availability.

Affected Products

• Autodesk 3ds Max 2026
• Autodesk 3ds Max 2027
• WRL (VRML) file parser component in autodesk:3ds_max

Discovery Timeline

• 2026-05-26 - CVE-2026-7452 published to the National Vulnerability Database (NVD)
• 2026-05-26 - Autodesk Security Advisory ADSK-SA-2026-0006 published
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-7452

Vulnerability Analysis

The vulnerability resides in the WRL (VRML) file parser within Autodesk 3ds Max. When the application processes a malformed WRL file, the parser writes data outside the bounds of an allocated buffer. This memory corruption condition allows attackers to overwrite adjacent memory structures, including function pointers or return addresses. The attack requires local file access and user interaction, since the target must open the crafted file in 3ds Max. Once triggered, the attacker gains code execution within the 3ds Max process and inherits its privileges. The flaw impacts confidentiality, integrity, and availability of the affected workstation.

Root Cause

The root cause is improper validation of input size during WRL file parsing, mapped to [CWE-120]. The parser copies attacker-controlled data into a fixed-size buffer without verifying that the source length fits within the destination. Crafted geometry, node, or field data within the WRL file forces the unchecked copy operation to overflow the buffer.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers the malicious WRL file through phishing email, a compromised asset repository, or a third-party model marketplace. The victim opens or imports the file in Autodesk 3ds Max 2026 or 2027. Parsing the file triggers the memory corruption and executes the embedded payload in the user's security context. No elevated privileges are required for the initial exploitation.

No public proof-of-concept exploit code has been published. Refer to the Autodesk Security Advisory ADSK-SA-2026-0006 for vendor-supplied technical details.

Detection Methods for CVE-2026-7452

Indicators of Compromise

• Unexpected 3dsmax.exe child processes such as cmd.exe, powershell.exe, or rundll32.exe following WRL file open events
• WRL files originating from untrusted email attachments, downloads, or shared asset repositories
• 3ds Max process crashes or access violation events logged in the Windows Application event log around the time a WRL file is imported
• Outbound network connections initiated by 3dsmax.exe to unknown infrastructure shortly after file import

Detection Strategies

• Hunt for process lineage where 3dsmax.exe spawns scripting interpreters or LOLBins, which is anomalous for a 3D modeling workflow
• Inspect file system telemetry for .wrl or .vrml files written to temporary directories or user download folders prior to a 3ds Max launch event
• Correlate Windows Error Reporting (WER) crash dumps for 3dsmax.exe with WRL file open operations to surface failed exploitation attempts

Monitoring Recommendations

• Enable Windows Defender Application Control or AppLocker logging to record execution attempts originating from the 3ds Max process tree
• Forward endpoint process, file, and network telemetry to a centralized SIEM or data lake for retrospective hunting on .wrl file activity
• Monitor Autodesk Access for installed 3ds Max versions and flag hosts that remain on vulnerable 2026 or 2027 builds

How to Mitigate CVE-2026-7452

Immediate Actions Required

• Apply the patched 3ds Max version specified in Autodesk Security Advisory ADSK-SA-2026-0006 on all affected workstations
• Instruct artists and engineers to avoid opening WRL or VRML files received from untrusted sources or unverified asset stores
• Inventory hosts running 3ds Max 2026 and 2027 and prioritize remediation on systems handling externally sourced 3D assets

Patch Information

Autodesk has released fixes through Autodesk Access. Refer to Autodesk Security Advisory ADSK-SA-2026-0006 for the specific patched build numbers and download instructions. Use the Autodesk Access client to deploy updates across managed endpoints.

Workarounds

• Block inbound .wrl and .vrml file attachments at the email gateway until patching is complete
• Restrict 3ds Max import paths to vetted internal asset libraries using file system access controls
• Run 3ds Max under a standard (non-administrator) user account to limit the impact of arbitrary code execution
• Use application allowlisting to prevent 3dsmax.exe from spawning command interpreters or unsigned binaries

# Example: block .wrl files from executing via Exchange transport rule (PowerShell)
New-TransportRule -Name "Block WRL Attachments" \
  -AttachmentExtensionMatchesWords "wrl","vrml" \
  -RejectMessageReasonText "WRL/VRML attachments are blocked pending CVE-2026-7452 remediation."