High severity · published Dec 19, 2022
CVE-2022-42946
Parsing a maliciously crafted X_B and PRT file can force Autodesk Maya 2023 and 2022 to read beyond allocated buffer
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
Parsing a maliciously crafted X_B and PRT file can force Autodesk Maya 2023 and 2022 to read beyond allocated buffer. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Maya · Autodesk
2023 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-42946
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-42946
Vendor Advisory
https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0020
More from Maya
7.8
CVE-2022-42947
A maliciously crafted X_B file when parsed through Autodesk Maya 2023 and 2022 can be used to write beyond the allocated buffer
6.6
CVE-2025-4605
USD File Parsing Memory Allocation Vulnerability