CVE-2026-7453: Autodesk 3ds Max DOS Vulnerability

CVE-2026-7453 Overview

CVE-2026-7453 is a stack exhaustion vulnerability in Autodesk 3ds Max that occurs when the application parses a maliciously crafted WRL (VRML) file. The flaw maps to CWE-674: Uncontrolled Recursion and results in a denial-of-service condition for the affected application. Exploitation requires local access and user interaction, since the victim must open the malicious file in 3ds Max. The vulnerability does not expose confidentiality or integrity of data but causes the application to terminate. Autodesk published advisory ADSK-SA-2026-0006 addressing the issue.

Critical Impact

A crafted WRL file opened in Autodesk 3ds Max 2026 or 2027 exhausts the call stack and crashes the application, disrupting design workflows and risking loss of unsaved work.

Affected Products

• Autodesk 3ds Max 2026
• Autodesk 3ds Max 2027
• WRL (VRML) file parser component within 3ds Max

Discovery Timeline

• 2026-05-26 - CVE-2026-7453 published to NVD
• 2026-05-26 - Autodesk publishes security advisory ADSK-SA-2026-0006
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-7453

Vulnerability Analysis

The vulnerability resides in the WRL file parser used by Autodesk 3ds Max. WRL is the file format for Virtual Reality Modeling Language (VRML) scene descriptions. The parser processes nested scene graph nodes without enforcing a recursion depth limit. When the parser encounters deeply nested or self-referential constructs, each level consumes additional stack frames. The thread eventually exhausts its allocated stack space and the process terminates.

This category of flaw is classified as [CWE-674: Uncontrolled Recursion]. The result is a denial-of-service condition affecting only the local 3ds Max session. The vulnerability does not leak information and does not provide a path to code execution based on available data.

Root Cause

The root cause is the absence of a depth check during recursive parsing of WRL scene graph elements. A WRL file can declare arbitrarily nested grouping nodes, inline references, and prototype definitions. The parser invokes itself for each nested element. Without a bounded depth counter or an iterative parsing strategy, attacker-controlled input directly controls call stack growth.

Attack Vector

Exploitation requires the victim to open a crafted WRL file in Autodesk 3ds Max. An attacker delivers the malicious file through email attachments, shared project repositories, asset marketplaces, or supply-chain compromise of third-party model libraries. Once the user imports or opens the file, the parser recurses until the stack is exhausted and 3ds Max crashes. The attack vector is local with user interaction required, and impact is limited to availability of the application.

No public proof-of-concept code is available. The vulnerability mechanism is described in Autodesk advisory ADSK-SA-2026-0006.

Detection Methods for CVE-2026-7453

Indicators of Compromise

• Unexpected crashes of 3dsmax.exe shortly after opening or importing a .wrl file
• Windows Error Reporting events referencing stack overflow exceptions (0xC00000FD) in the 3ds Max process
• WRL files with abnormally deep nesting of Group, Transform, or Inline nodes received from untrusted sources

Detection Strategies

• Monitor process termination events for 3dsmax.exe and correlate with recent file open operations targeting .wrl extensions
• Inspect WRL files at email and file-sharing gateways for excessive node nesting depth before delivery to designers
• Hunt for anomalous file delivery patterns that place WRL files in shared CAD or 3D asset directories

Monitoring Recommendations

• Enable application crash logging on workstations running 3ds Max 2026 and 2027 and forward Windows Event Log Application channel events to a central log platform
• Track file system events for .wrl file creation in user download and project directories
• Alert on repeated crashes of the same workstation, which may indicate targeted delivery of malicious assets

How to Mitigate CVE-2026-7453

Immediate Actions Required

• Apply the update referenced in Autodesk security advisory ADSK-SA-2026-0006 using Autodesk Access
• Restrict opening of WRL files received from external or untrusted sources until patching is complete
• Inventory workstations running 3ds Max 2026 and 2027 and prioritize them for remediation

Patch Information

Autodesk released fixed builds of 3ds Max addressed in advisory ADSK-SA-2026-0006. Deploy the update through Autodesk Access or the Autodesk Account portal. Verify the installed version against the fixed build listed in the advisory after deployment.

Workarounds

• Avoid importing WRL files from untrusted email attachments, web downloads, or third-party model repositories
• Validate WRL files in an isolated sandbox or non-production workstation before opening them in production environments
• Convert untrusted WRL assets to alternative formats using a hardened, offline conversion utility prior to import

# Example: identify WRL files in user directories for review prior to patch deployment
Get-ChildItem -Path C:\Users -Recurse -Include *.wrl -ErrorAction SilentlyContinue |
  Select-Object FullName, Length, LastWriteTime |
  Export-Csv -Path C:\Temp\wrl_inventory.csv -NoTypeInformation