CVE-2026-0659

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0659", "assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601", "state": "PUBLISHED", "assignerShortName": "autodesk", "dateReserved": "2026-01-06T19:58:21.363Z", "datePublished": "2026-02-04T16:01:27.307Z", "dateUpdated": "2026-02-26T15:04:20.838Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:autodesk:usd_for_arnold:arnold_usd_7.4.4.1:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "USD for Arnold", "vendor": "Autodesk", "versions": [{"lessThan": "7.4.4.2", "status": "affected", "version": "7.4.4.1", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:autodesk:arnold:7.4.4.2:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Arnold", "vendor": "Autodesk", "versions": [{"lessThan": "7.4.4.2", "status": "affected", "version": "7.4.4.1", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:autodesk:3ds_max:2026.2:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "3ds Max", "vendor": "Autodesk", "versions": [{"lessThan": "2026.3.2", "status": "affected", "version": "2026.2", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A maliciously crafted USD file, when loaded or imported into Autodesk Arnold or Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."}], "value": "A maliciously crafted USD file, when loaded or imported into Autodesk Arnold or Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601", "shortName": "autodesk", "dateUpdated": "2026-02-04T16:01:27.307Z"}, "references": [{"tags": ["patch"], "url": "https://www.autodesk.com/products/autodesk-access/overview"}, {"tags": ["patch"], "url": "https://github.com/Autodesk/arnold-usd"}, {"tags": ["vendor-advisory"], "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0003"}], "source": {"discovery": "EXTERNAL"}, "title": "USD File Parsing Out-of-Bounds Write Vulnerability", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0659", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-06T04:55:25.642059Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:04:20.838Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0659", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-06T04:55:25.642059Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:38:35.606Z"}}], "cna": {"title": "USD File Parsing Out-of-Bounds Write Vulnerability", "source": {"discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:autodesk:usd_for_arnold:arnold_usd_7.4.4.1:*:*:*:*:*:*:*"], "vendor": "Autodesk", "product": "USD for Arnold", "versions": [{"status": "affected", "version": "7.4.4.1", "lessThan": "7.4.4.2", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:autodesk:arnold:7.4.4.2:*:*:*:*:*:*:*"], "vendor": "Autodesk", "product": "Arnold", "versions": [{"status": "affected", "version": "7.4.4.1", "lessThan": "7.4.4.2", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:autodesk:3ds_max:2026.2:*:*:*:*:*:*:*"], "vendor": "Autodesk", "product": "3ds Max", "versions": [{"status": "affected", "version": "2026.2", "lessThan": "2026.3.2", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.autodesk.com/products/autodesk-access/overview", "tags": ["patch"]}, {"url": "https://github.com/Autodesk/arnold-usd", "tags": ["patch"]}, {"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0003", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A maliciously crafted USD file, when loaded or imported into Autodesk Arnold or Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.", "supportingMedia": [{"type": "text/html", "value": "A maliciously crafted USD file, when loaded or imported into Autodesk Arnold or Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601", "shortName": "autodesk", "dateUpdated": "2026-02-04T16:01:27.307Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0659", "state": "PUBLISHED", "dateUpdated": "2026-02-26T15:04:20.838Z", "dateReserved": "2026-01-06T19:58:21.363Z", "assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601", "datePublished": "2026-02-04T16:01:27.307Z", "assignerShortName": "autodesk"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:autodesk:usd_for_arnold:arnold_usd_7.4.4.1:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "USD for Arnold", "vendor": "Autodesk", "versions": [{"lessThan": "7.4.4.2", "status": "affected", "version": "7.4.4.1", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:autodesk:arnold:7.4.4.2:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Arnold", "vendor": "Autodesk", "versions": [{"lessThan": "7.4.4.2", "status": "affected", "version": "7.4.4.1", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:autodesk:3ds_max:2026.2:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "3ds Max", "vendor": "Autodesk", "versions": [{"lessThan": "2026.3.2", "status": "affected", "version": "2026.2", "versionType": "custom"}]}], "source": "psirt@autodesk.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A maliciously crafted USD file, when loaded or imported into Autodesk Arnold or Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."}, {"lang": "es", "value": "Un archivo USD manipulado maliciosamente, cuando se carga o importa en Autodesk Arnold o Autodesk 3ds Max, puede forzar una vulnerabilidad de escritura fuera de l\u00edmites. Un actor malicioso puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo arbitrario en el contexto del proceso actual."}], "id": "CVE-2026-0659", "lastModified": "2026-06-17T10:11:09.813", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "psirt@autodesk.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0659", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-06T04:55:25.642059Z", "version": "2.0.3"}}]}, "published": "2026-02-04T17:16:12.623", "references": [{"source": "psirt@autodesk.com", "url": "https://github.com/Autodesk/arnold-usd"}, {"source": "psirt@autodesk.com", "url": "https://www.autodesk.com/products/autodesk-access/overview"}, {"source": "psirt@autodesk.com", "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0003"}], "sourceIdentifier": "psirt@autodesk.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "psirt@autodesk.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T13:59:04.296468+00:00", "value": {"mitigation_remediation": ["Update Autodesk 3ds Max, Arnold, and USD for Arnold to a version that includes the fix as noted in the official advisory.", "Configure the applications or the operating environment to refuse loading USD files from untrusted directories or sources, and enable file integrity checks or code signing for imported assets.", "Apply application whitelisting or sandboxing policies to limit the potential impact of an exploited file, ensuring that any code executed from an untrusted USD file runs with minimal privileges."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary code execution within the target application"}, "threat_synthesis": {"affected_systems": "The affected software is Autodesk 3ds Max 2026.2, Autodesk Arnold 7.4.4.2, and USD for Arnold 7.4.4.1. These versions are listed in the CPE data. Any user who can load a USD file into one of these applications on a system where these versions are installed is susceptible.", "description_and_impact": "Autodesk can load USD files in its 3ds Max and Arnold products, and a specially crafted file triggers an out\u2011of\u2011bounds write that can be abused to execute arbitrary code in the process\u2019s context. The vulnerability is a classic out\u2011of\u2011bounds write (CWE\u2011787) that provides the attacker with full control over the execution flow of a vulnerable instance. It does not require any network connectivity; the malicious USD file must be processed locally during import or loading.", "risk_and_exploitability": "The CVSS score of 7.8 reflects a high impact when the vulnerability is successfully triggered. The EPSS score of less than 1% indicates that, as of the last measurement, exploitation is unlikely to be widespread, but it is still possible, especially within specialized production environments where USD files are manipulated. The vulnerability is not currently in the CISA KEV catalog. Because the attack only requires a user to import a file, the primary attack vector is local, though a compromised user or remotely controlled file import scenario could also be used. Once the out\u2011of\u2011bounds write occurs, an attacker can run arbitrary code with the privileges of the application process, potentially leading to system compromise."}}}}, "created": "2026-04-18T14:00:02.188370+00:00", "updated": "2026-04-18T14:00:02.188384+00:00", "vendors": []}