CVE-2023-40491 is a high severity use-after-free in how Maxon Cinema 4D parses SKP files. NVD scores it 7.8. Opening a crafted file can lead to code execution. The advisory names no fixed version, so avoid opening SKP files from untrusted sources until Maxon confirms a patch.
What's affected
The record lists one product: Cinema 4D, with the CPE vendor shown as nemetschek and version 2023.2.1. Maxon is part of the Nemetschek group, which explains the vendor field. The weakness is CWE-416, use after free.
The flaw is in the parsing of SKP files. According to the advisory, the code does not check that an object exists before it performs operations on that object. User interaction is required: the target must visit a malicious page or open a malicious file. The code runs in the context of the current process, so it has the rights of the user who opened the file. The vector in the record is local, low complexity, no privileges, user interaction required.
No fixed version is confirmed. The Zero Day Initiative advisory ZDI-23-1191 (ZDI-CAN-21439) shows ZDI asking for a vendor security contact on 15 June 2023 and trying again on 12 July and 17 August 2023, including through the vendor's website and social channels. The advisory was published on 24 August 2023 and updated on 3 May 2024. It does not report a vendor response or a patch. Check Maxon's own release notes for a version that addresses it.
The record is not flagged as a CISA Known Exploited Vulnerability, and the advisory does not say it is exploited in the wild.
How to check if you're exposed
This is a desktop application, so exposure means the app is installed and someone opens files with it. The record lists version 2023.2.1 and does not say whether other versions are affected.
Find the installed version from the application's About dialog, or from your software inventory. On Windows, you can also list installed programs:
Get-Package | Where-Object Name -like "*Cinema 4D*"
Then work out how SKP files reach those machines. SKP is the SketchUp file format. Email attachments, shared drives, asset marketplaces and download links are the usual routes. If artists on your team import SKP files from outside the company, those machines are the ones to prioritise.
What to do now
- Inventory every machine that runs Cinema 4D and note the version.
- Tell users not to open or import SKP files from sources they do not trust, and to treat unexpected files the same way as unexpected attachments.
- If SKP import is not needed, restrict it. The advisory says the only salient mitigation is to restrict interaction with the application.
- Keep these workstations on current endpoint protection and limit local admin rights, so a successful exploit runs with fewer privileges.
- Watch Maxon's release notes and the ZDI advisory for a fixed build, and update when one is named.
Why it matters
A use-after-free is a memory safety bug. The program frees an object, keeps a pointer to it, and later uses that pointer as if the object were still valid. An attacker who controls what ends up in that memory can steer what the program does next. File parsers are a common home for this class because they handle attacker-supplied structure and lifetimes are easy to get wrong.
The practical risk is bounded by the need for user interaction. Someone has to open the file. That still describes ordinary design workflows, where files arrive from clients, vendors and marketplaces, so the decision about which files to trust matters more than usual.
Quick check
Does the attacker need to be on my network?
No, but a person has to open a malicious file or visit a malicious page. The record lists a local attack vector with user interaction required.
Is there a patch for CVE-2023-40491?
None is named in the advisory or the record. Check Maxon's release notes before assuming one exists.
Sources
- Zero Day Initiative advisory ZDI-23-1191
- Safeguard Gold entry for CVE-2023-40491
- NVD record, as supplied in the Safeguard CVE dataset
Last reviewed: 19 October 2026.
