CVE-2026-0659

A maliciously crafted USD file, when loaded or imported into Autodesk Arnold or Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

Score

CVSS 3.1 7.8 High

Status

Deferred - psirt@autodesk.com

Published

2026-02-04

Last modified

2026-02-26

Weaknesses

CWE-787

Affected products

• 3ds Max (Autodesk)
• Arnold (Autodesk)
• Usd For Arnold (Autodesk)

References

• https://github.com/Autodesk/arnold-usd
• https://www.autodesk.com/products/autodesk-access/overview
• https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0003