CVE-2026-16782 is a medium severity (CVSS 5.3) out-of-bounds read in Autodesk 3ds Max, triggered by parsing a maliciously crafted SVG file. The record says it can cause a crash, a data read or code execution in the process. Autodesk advisory ADSK-SA-2026-0014 holds the fixed versions.
What's affected
Autodesk 3ds Max, per the NVD record. The record does not list affected or fixed version numbers. It points to Autodesk advisory ADSK-SA-2026-0014 and to the Autodesk Access overview page.
When I tried to fetch the advisory, Autodesk's site returned an access denied response, so I could not confirm the affected releases or the fixed release. Do not guess. Open the advisory in a browser and read the version table, then compare it with your installed 3ds Max.
How to check if you're exposed
In 3ds Max, open the Help menu and choose About to read the product version and update level. Compare it with the table in advisory ADSK-SA-2026-0014.
Autodesk Access, the desktop updater, shows pending updates for installed products. Open it and see whether a security update is waiting. Also think about where SVG files come from in your pipeline. Files from outside sources, such as asset marketplaces or client handoffs, are the ones to treat with care.
What to do now
- Open advisory ADSK-SA-2026-0014 and note the affected and fixed versions.
- Read the installed version in 3ds Max under Help, About.
- Install the update through Autodesk Access or the Autodesk account portal.
- Until updated, avoid opening SVG files from sources you do not trust.
- Keep render farm and shared workstation images in step with the patched build.
Why it matters
CWE-125 is an out-of-bounds read. The parser reads memory outside the buffer it should be limited to, which can crash the application, leak data, or in some cases be shaped into code execution. Autodesk's description names all three outcomes.
The CVSS vector in the record shows a network vector with no user interaction, which looks unusual for a file parser bug that depends on a crafted file. Both the vector and the description are quoted here as published. The 5.3 score is medium, but design workstations often hold valuable assets, so apply the update on a normal schedule.
The weakness class here is CWE-125 (Out-of-bounds Read). The NVD record scores it 5.3, which is medium severity. The CVSS vector reads attack vector over the network, low attack complexity, no privileges required, no user interaction. Scope is unchanged. Impact on confidentiality, integrity and availability is rated low, none and none. The record's KEV flag is false, so this CVE is not in CISA's Known Exploited Vulnerabilities catalog, and the advisory I fetched does not report exploitation.
Safeguard's Gold directory tracks this CVE, and reachability analysis helps you decide which affected components matter most for your own software.
Quick check
Does opening an SVG always trigger the flaw?
No. The record says a maliciously crafted SVG is needed. Normal SVG files are not the concern, but files from unknown sources are.
Sources
- Autodesk advisory ADSK-SA-2026-0014 (returned access denied when fetched)
- Safeguard Gold entry for CVE-2026-16782, which summarizes the NVD record
Last reviewed: 18 October 2026.
