CVE-2023-40486 is a high severity (CVSS 7.8) stack-based buffer overflow in the way Maxon Cinema 4D parses SKP files. A malicious file or page can lead to code execution. The advisory lists no vendor fix, and its only mitigation is to restrict interaction with the application.
What's affected
The record names Cinema 4D 2023.2.1 (listed under the Nemetschek vendor name in the CPE data) and scores the flaw 7.8 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. It needs a user to open a file, and the impact is code execution in the context of the current process. The weakness is CWE-121.
Our sources do not give a fixed version. The Zero Day Initiative advisory ZDI-23-1186 (tracked as ZDI-CAN-21434) is the public report. For the sibling advisory ZDI-23-1184, which we read in full, ZDI says it asked for a vendor security contact on 2023-06-15 and tried again on 2023-07-12 and 2023-08-17, and then published on 2023-08-24 with the note that the only salient mitigation is to restrict interaction with the application. The advisory for this CVE carries a mitigation note as well. Check Maxon's own release notes for a later build before you conclude you are exposed or fixed.
This is one of eight SKP parsing flaws published at the same time: CVE-2023-40482, CVE-2023-40483, CVE-2023-40484, CVE-2023-40485, CVE-2023-40487, CVE-2023-40488, CVE-2023-40489. Each has its own ZDI advisory and its own CVE, and they fall into three classes: out-of-bounds writes, stack-based buffer overflows and use-after-free bugs. The record is not marked as a CISA Known Exploited Vulnerability.
How to check if you're exposed
Open Cinema 4D and read the version under Help, then About. The record names 2023.2.1. If you cannot confirm which build a studio machine runs, ask the people who administer the workstation images.
Then look at where SKP files come from. SKP is the file format used by SketchUp, and design teams often receive models from clients, marketplaces and contractors. List the shared folders, download locations and email routes through which SKP files arrive on machines that run Cinema 4D.
An open source dependency scan will not see this, because it is a desktop product. Track it in your software inventory instead.
What to do now
- Find every workstation and render node that has Cinema 4D installed, and record the version.
- Check Maxon's release notes and support channel for a build that addresses this advisory, and update if one exists.
- Until a fix is confirmed, do not open SKP files from sources you do not trust, and do not import them on machines that hold credentials or project secrets.
- Open untrusted models on an isolated machine or virtual machine that can be reset.
- Keep the evidence of your check in your software inventory so you can answer the next customer questionnaire quickly.
Why it matters
The weakness is a stack-based buffer overflow (CWE-121) in code that reads a file format. File parsers are a common source of memory errors because they handle data that someone else controls, with lengths and counts that the parser has to check. The record says the parser does not validate the length of user supplied data before copying it into a fixed length buffer on the stack. The record lists both CWE-121 and CWE-787 for this entry. Overflows of that kind can overwrite control data held next to the buffer.
The attack needs a person to open a file, so the practical defense is controlling which files reach the application. Without a vendor fix to point to, that control is the whole mitigation. ZDI's advice, that the only salient mitigation is to restrict interaction with the application, reflects the same limit.
Quick check
Is a patch available?
Neither the record nor the ZDI advisories we read name a fixed version. The record lists Cinema 4D 2023.2.1 as affected. Check Maxon's release notes for the current position.
Does this need a network attacker?
No. The vector is local and needs user interaction. The risk comes from opening a crafted file or visiting a crafted page, not from a service listening on the network.
Sources
Last reviewed: 19 October 2026.
