CVE-2026-7455: Autodesk 3ds Max FLT File RCE Vulnerability

CVE-2026-7455 Overview

CVE-2026-7455 is an out-of-bounds write vulnerability in Autodesk 3ds Max triggered by parsing a maliciously crafted FLT file. An attacker who convinces a user to open a specially crafted FLT file can cause the application to crash, corrupt data, or execute arbitrary code in the context of the current process. The flaw is classified as [CWE-787] Out-of-bounds Write and requires local file access with user interaction. Autodesk documented the issue in security advisory ADSK-SA-2026-0014.

Critical Impact

Successful exploitation allows arbitrary code execution within the 3ds Max process, giving attackers the same privileges as the logged-in user.

Affected Products

• Autodesk 3ds Max (see Autodesk Security Advisory ADSK-SA-2026-0014 for affected versions)
• FLT (OpenFlight) file parser component within 3ds Max
• Systems using Autodesk Access for update management

Discovery Timeline

• 2026-08-24 - CVE-2026-7455 published to the National Vulnerability Database
• 2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-7455

Vulnerability Analysis

The vulnerability resides in the FLT file parsing logic within Autodesk 3ds Max. FLT is the OpenFlight scene description format used for 3D model interchange. When 3ds Max reads a crafted FLT file, the parser writes data past the end of an allocated buffer. This out-of-bounds write can overwrite adjacent memory structures, function pointers, or heap metadata.

An attacker who controls the values written can steer execution flow toward attacker-supplied shellcode or ROP gadgets. The result is arbitrary code execution within the 3ds Max process, plus potential data corruption of open scenes and cached assets. Refer to Autodesk Security Advisory ADSK-SA-2026-0014 for vendor-specific technical details and fixed builds.

Root Cause

The root cause is insufficient bounds validation in the FLT parser [CWE-787]. Length fields, record counts, or offsets embedded in the FLT file are trusted without verifying they fit within destination buffer allocations. Parsing malformed record sizes causes memory writes beyond the intended buffer region.

Attack Vector

Exploitation requires local delivery and user interaction. An attacker crafts a malicious .flt file and delivers it through email, shared project repositories, asset marketplaces, or supply-chain injection into legitimate model libraries. The victim opens or imports the file in 3ds Max, and the parser triggers the out-of-bounds write. No authentication is required against 3ds Max itself.

No verified public exploit code or proof-of-concept is available at this time. See Autodesk Security Advisory ADSK-SA-2026-0014 for parser-level details.

Detection Methods for CVE-2026-7455

Indicators of Compromise

• Unexpected crashes of 3dsmax.exe correlated with opening or importing .flt files
• Windows Error Reporting entries citing access violations in 3ds Max FLT parsing modules
• .flt files arriving from untrusted email attachments, external shares, or unverified marketplace downloads
• Child processes spawned by 3dsmax.exe such as cmd.exe, powershell.exe, or rundll32.exe shortly after file open

Detection Strategies

• Monitor process creation events where 3dsmax.exe is the parent of shell or scripting interpreters
• Alert on write operations to autorun locations, scheduled tasks, or startup folders performed by 3dsmax.exe
• Inspect file gateways and endpoint agents for .flt files with anomalous size, structure, or origin

Monitoring Recommendations

• Enable command-line and process-lineage logging on workstations running 3ds Max
• Forward endpoint telemetry to a central analytics platform to correlate crashes with subsequent suspicious activity
• Track outbound network connections initiated by 3dsmax.exe to non-Autodesk destinations

How to Mitigate CVE-2026-7455

Immediate Actions Required

• Apply the fixed 3ds Max release identified in Autodesk Security Advisory ADSK-SA-2026-0014 as soon as it is available in your environment
• Use Autodesk Access to inventory installed 3ds Max versions and drive patch deployment
• Instruct artists and engineers not to open .flt files received from untrusted or unverified sources
• Restrict 3ds Max user accounts to standard privileges to limit blast radius on exploitation

Patch Information

Autodesk has published patch guidance in ADSK-SA-2026-0014. Administrators should consult the advisory for the specific fixed build numbers and deploy through Autodesk Access or the standard software distribution channel used by their organization.

Workarounds

• Block inbound .flt attachments at email and web gateways until patching completes
• Require review of third-party FLT assets in a sandboxed workstation before ingestion into production pipelines
• Enforce application allowlisting to prevent unauthorized child processes from launching under 3dsmax.exe

# Example: block .flt attachments at the mail gateway (pseudo-config)
rule block_flt_attachments {
    match: attachment.extension == "flt"
    action: quarantine
    notify: security-ops@example.com
}