Unscored severity · published Nov 24, 2009
CVE-2009-3577
Autodesk 3D Studio Max (3DSMax) 6 through 9 and 2008 through 2010 allows remote attackers to execute arbitrary code via a .max file with a MAXScript statement that calls the…
–
CVSS
5.1%
EPSS
No
On KEV
Description
Autodesk 3D Studio Max (3DSMax) 6 through 9 and 2008 through 2010 allows remote attackers to execute arbitrary code via a .max file with a MAXScript statement that calls the DOSCommand method, related to "application callbacks."
Exploitation
Is it being used?
Exploit prediction (EPSS)5.1% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
3M
3ds Max · Autodesk
6; 7; 8; 9; 2008; 2009; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3577
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3577
securitytracker.com
http://securitytracker.com/id?1023230
Exploit
http://www.coresecurity.com/content/3dsmax-arbitrary-command-execution
www.securityfocus.com
http://www.securityfocus.com/archive/1/508012/100/0/threaded
Exploit
http://www.securityfocus.com/bid/36634
More from 3ds Max
8.4
CVE-2026-0660
Stack Based Buffer Overflow in GIF File Parsing
8.4
CVE-2026-0661
Out-of-Bounds Write in RGB File Parsing
8.4
CVE-2026-0537
RGB File Parsing Memory Corruption
8.4
CVE-2026-0538
GIF File Parsing Out-of-Bounds Write
7.8
CVE-2026-19568
SVG File Parsing Memory Corruption Vulnerability in Autodesk 3ds Max