CVE-2026-0662: Untrusted Search Path Vulnerability when opening max Files

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-04 · updated 2026-06-17
Weakness: CWE-426

Description

A maliciously crafted project directory, when opening a max file in Autodesk 3ds Max, could lead to execution of arbitrary code in the context of the current process due to an Untrusted Search Path being utilized.

Affected products

Autodesk 3ds Max: from 2026 before 2026.3.2 — fixed in 2026.3.2

How to fix

Upgrade to a fixed version: Autodesk 3ds Max 2026.3.2. Check the vendor advisory for mitigations.

References

https://www.autodesk.com/products/autodesk-access/overview
https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0002

Get alerted when CVE-2026-0662 or the next vulnerability affects your stack