Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-16782

CVE-2026-16782HIGH

Autodesk 3ds Max — SVG File Parsing Out-of-Bounds Read Vulnerability in Autodesk 3ds Max

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   N   R  U  H  H  H    7.8   .0021    9.9     —

AFFECTED
  Product  Versions    Fixed
  3ds Max  2027.0.0 –  —

TIMELINE
  Jul 23  Reserved by autodesk
  Aug 24  Published (CNA: autodesk)
  Aug 28  RESCORED — CVE-2026-16782 (Autodesk 3ds Max). CVSS 5.3 → 7.8 (NVD).

CWE-125 · CNA: autodesk · CVSS v3.1 · 2 references · NVD status: Analyzed

Description

A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
July 23, 2026	Reserved	Reserved by autodesk
August 24, 2026	Published	Published (CNA: autodesk)
August 28, 2026	RESCORED	RESCORED — CVE-2026-16782 (Autodesk 3ds Max). CVSS 5.3 → 7.8 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Autodesk	3ds Max	—	2027.0.0	—

Weaknesses

CWE-125

References (2)

https://www.autodesk.com/products/autodesk-access/overview [Product]
https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0014 [Vendor Advisory]

Authoritative record: CVE-2026-16782 at cve.org

Vendors: autodesk

Weaknesses: CWE-125

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-16782 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.