Security readout for executives and security teams
Plain-English summary
CVE-2026-0662 affects Autodesk 3ds Max 2026. If a user opens a .max file from a maliciously crafted project directory, code could run with that user’s privileges. This is most relevant to teams receiving 3D project files from customers, partners, marketplaces, or external contractors.
Executive priority
Prioritize remediation for design, animation, engineering, and visualization teams using 3ds Max 2026 with external files. The issue requires user interaction but can lead to full impact within the user process, making it important for targeted workstation hardening.
Technical view
The issue is an untrusted search path vulnerability, CWE-426, in Autodesk 3ds Max 2026 when opening max files. The CVSS 3.1 score is 7.8, local attack vector, low complexity, no privileges required, and user interaction required. Successful exploitation can impact confidentiality, integrity, and availability in the current process context.
Likely exposure
Exposure is limited to environments running Autodesk 3ds Max 2026, especially workstations that open externally supplied project directories or max files. Systems not using 3ds Max 2026 are listed as unaffected by default in the provided CVE data.
Exploitation context
The attack requires convincing a user to open a max file within a malicious project directory. The source bundle does not indicate known active exploitation, and the CVE is not marked as CISA KEV.
Researcher notes
Public details identify the vulnerability class and trigger condition but do not provide deeper technical indicators or exploit status. Validate using vendor advisory information rather than assumptions about search order, file names, or affected components.
Mitigation direction
- Review Autodesk advisory ADSK-SA-2026-0002 for affected builds and update instructions.
- Use Autodesk Access or approved software management to apply vendor-provided security updates.
- Avoid opening untrusted 3ds Max project directories until updated.
- Handle external project files in controlled workstations or sandboxed workflows where feasible.
Validation and detection
- Inventory endpoints for Autodesk 3ds Max 2026 installations.
- Check installed 3ds Max build against Autodesk advisory guidance.
- Confirm Autodesk Access or enterprise deployment tools show the relevant security update applied.
- Review creative workflows for receipt of external max files and project directories.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-426: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-0662 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.autodesk.com/products/autodesk-access/overviewCVE reference · patch
- https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0002CVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Untrusted Search Path
Untrusted Search Path represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.