What’s Vulnerable › Vulnerabilities

CVE-2009-3577

• Severity: critical (CVSS 9.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2009-11-24 · updated 2026-06-16
• Weakness: CWE-94

Description

Autodesk 3D Studio Max (3DSMax) 6 through 9 and 2008 through 2010 allows remote attackers to execute arbitrary code via a .max file with a MAXScript statement that calls the DOSCommand method, related to "application callbacks."

Affected products

• Autodesk 3ds Max: 6, 7, 8, 9, 2008, 2009 (+1)

References

• http://securitytracker.com/id?1023230
• http://www.coresecurity.com/content/3dsmax-arbitrary-command-execution
• http://www.securityfocus.com/archive/1/508012/100/0/threaded
• http://www.securityfocus.com/bid/36634
• http://securitytracker.com/id?1023230
• http://www.coresecurity.com/content/3dsmax-arbitrary-command-execution
• http://www.securityfocus.com/archive/1/508012/100/0/threaded
• http://www.securityfocus.com/bid/36634

Get alerted when CVE-2009-3577 or the next vulnerability affects your stack