CVE-2023-25009

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds write vulnerability which could result in code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	Autodesk 3ds Max USD Plugin	0.3

References

https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0008Vendor Advisory
https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0008Vendor Advisory

Timeline

Published: May 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-250107.8A malicious actor may convince a victim to open a malicious USD file that may trigger an uninitialized variable which may result in code exe CVE-2023-250117.8PC settings tool Ver10.1.26.0 and earlier, PC settings tool Ver11.0.22.0 and earlier allows a attacker to write to the registry as administr CVE-2023-250124.6The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED CVE-2023-250137.5An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in CVE-2023-250147.5An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in CVE-2023-250156.5Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.CVE-2023-250167.5Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor.CVE-2023-250178.1RIFARTEK IOT Wall has a vulnerability of incorrect authorization. An authenticated remote attacker with general user privilege is allowed to CVE-2023-250185.4RIFARTEK IOT Wall transportation function has insufficient filtering for user input. An authenticated remote attacker with general user priv CVE-2023-250196.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Premio Chaty plugin <= 3.0.9 versions CVE-2023-250206.1Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1.1 versions.CVE-2023-250214.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in FareHarbor FareHarbor for WordPress plugin <= 3.6.6 versions.