CVE-2026-7454: Autodesk 3ds Max RCE Vulnerability

CVE-2026-7454 Overview

CVE-2026-7454 is a memory corruption vulnerability in Autodesk 3ds Max triggered by parsing a maliciously crafted WRL (VRML) file. An attacker who convinces a user to open a weaponized WRL file can execute arbitrary code in the context of the current user process. The flaw is classified under [CWE-120] (Buffer Copy without Checking Size of Input) and affects Autodesk 3ds Max versions 2026 and 2027. Autodesk published advisory ADSK-SA-2026-0006 documenting the issue. Exploitation requires local file access and user interaction, but successful exploitation yields high impact to confidentiality, integrity, and availability.

Critical Impact

Arbitrary code execution in the context of the current user via a crafted WRL file opened in Autodesk 3ds Max.

Affected Products

• Autodesk 3ds Max 2026
• Autodesk 3ds Max 2027
• WRL/VRML file import functionality in 3ds Max

Discovery Timeline

• 2026-05-26 - CVE-2026-7454 published to NVD
• 2026-05-26 - Last updated in NVD database
• 2026-05-28 - EPSS scoring published

Technical Details for CVE-2026-7454

Vulnerability Analysis

The vulnerability resides in the WRL file parser used by Autodesk 3ds Max. WRL files encode Virtual Reality Modeling Language (VRML) scene data, including geometry, materials, and node hierarchies. When 3ds Max parses a maliciously structured WRL file, the parser fails to validate the size of input data before copying it into a fixed-size buffer. This results in memory corruption that an attacker can shape to overwrite adjacent control structures or function pointers.

The vulnerability is classified as [CWE-120], a classic buffer copy without bounds checking. Because 3ds Max parses WRL data in-process, any corruption occurs within the application's address space and inherits the privileges of the user running 3ds Max.

Root Cause

The root cause is insufficient validation of length fields or token boundaries within the WRL parser. VRML structures such as Coordinate, IndexedFaceSet, and string nodes require explicit bounds checks when populating heap or stack buffers. Missing or incorrect checks allow attacker-controlled data to exceed allocated memory regions, corrupting adjacent objects.

Attack Vector

Exploitation requires a local attack vector with user interaction. An attacker delivers a crafted WRL file through email, a shared project repository, an asset marketplace, or a compromised website. When the victim opens or imports the file in 3ds Max, the parser triggers the memory corruption, allowing code execution as the current user. No elevated privileges are required to weaponize the file. Refer to the Autodesk Security Advisory ADSK-SA-2026-0006 for technical specifics from the vendor.

No verified proof-of-concept code is publicly available for CVE-2026-7454.
The vulnerability is triggered by opening a malformed WRL (VRML) file in
Autodesk 3ds Max 2026 or 2027. Refer to the vendor advisory for details.

Detection Methods for CVE-2026-7454

Indicators of Compromise

• Unexpected 3dsmax.exe child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned after opening a WRL file
• WRL files arriving from untrusted sources, especially via email attachments or external file shares
• 3ds Max crash dumps referencing the WRL/VRML import module
• Outbound network connections initiated by 3dsmax.exe to unfamiliar destinations following file import

Detection Strategies

• Monitor process lineage where 3dsmax.exe is the parent of script interpreters or shell binaries
• Inspect file system telemetry for .wrl files written to user-writable locations followed by 3ds Max activity
• Apply YARA rules targeting anomalous VRML node structures with oversized string or index fields
• Correlate 3ds Max crash events in Windows Application logs with subsequent suspicious process activity

Monitoring Recommendations

• Enable command-line auditing and module load logging on workstations running 3ds Max
• Forward endpoint telemetry to a central SIEM or data lake for retroactive hunting
• Alert on 3ds Max processes loading non-standard DLLs or making outbound HTTP/HTTPS connections
• Track WRL file ingress through email gateways and managed file transfer systems

How to Mitigate CVE-2026-7454

Immediate Actions Required

• Apply the patched 3ds Max release referenced in Autodesk Security Advisory ADSK-SA-2026-0006
• Restrict opening of WRL files to those originating from trusted, verified sources
• Inventory all hosts running 3ds Max 2026 and 2027 and prioritize them for patching
• Inform 3D artists and pipeline engineers of the threat and require validation of external assets

Patch Information

Autodesk has published security advisory ADSK-SA-2026-0006 covering CVE-2026-7454. Administrators should consult the Autodesk advisory for the exact fixed builds and deploy them through Autodesk Access or the standard 3ds Max update channel. Confirm the installed version matches or exceeds the vendor-specified fixed release after deployment.

Workarounds

• Block or quarantine .wrl and .vrml files at email and web gateways until patches are deployed
• Use application allowlisting to prevent 3dsmax.exe from spawning script interpreters or shell binaries
• Open untrusted WRL files only inside isolated virtual machines without network access
• Apply least-privilege principles so 3ds Max users do not run with administrative rights

# Example: enumerate WRL files introduced in the last 7 days for review
Get-ChildItem -Path C:\Users -Recurse -Include *.wrl,*.vrml -ErrorAction SilentlyContinue |
  Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-7) } |
  Select-Object FullName, CreationTime, Length