CVE-2025-11795

A maliciously crafted JPG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.autodesk.com/products/autodesk-access/overview	Product
https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0023	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:autodesk:3ds_max:*:*:*:*:*:*:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Un archivo JPG creado maliciosamente, al ser analizado por Autodesk 3ds Max, puede forzar una vulnerabilidad de escritura fuera de límites. Un actor malicioso puede aprovechar esta vulnerabilidad para ejecutar código arbitrario en el contexto del proceso actual.

Information

Published : 2025-11-12 17:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-11795

Mitre link : CVE-2025-11795

CVE.ORG link : CVE-2025-11795

JSON object : View

Products Affected

autodesk

3ds_max

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2025-11795", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11795", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-13T04:55:41.020136Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@autodesk.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "psirt@autodesk.com", "affectedData": [{"cpes": ["cpe:2.3:a:autodesk:3ds_max:2026:*:*:*:*:*:*:*"], "vendor": "Autodesk", "product": "3ds Max", "versions": [{"status": "affected", "version": "2026", "lessThan": "2026.3", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-12T17:15:34.780", "references": [{"url": "https://www.autodesk.com/products/autodesk-access/overview", "tags": ["Product"], "source": "psirt@autodesk.com"}, {"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0023", "tags": ["Vendor Advisory"], "source": "psirt@autodesk.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@autodesk.com", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A maliciously crafted JPG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."}, {"lang": "es", "value": "Un archivo JPG creado maliciosamente, al ser analizado por Autodesk 3ds Max, puede forzar una vulnerabilidad de escritura fuera de l\u00edmites. Un actor malicioso puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo arbitrario en el contexto del proceso actual."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:autodesk:3ds_max:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A8AEDD4-C173-4992-BB67-3E3F90BAF832", "versionEndExcluding": "2026.3", "versionStartIncluding": "2026"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@autodesk.com"}