CVE-2026-0538

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Feb 4, 2026
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-05398.5Incorrect Default Permissions in pcvisit service binary on Windows allows a low-privileged local attacker to escalate their privileges by ovCVE-2026-05406.1DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attCVE-2026-05417.3ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privCVE-2026-05429.2ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could CVE-2026-05436.5Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a CVE-2026-05449.8A security flaw has been discovered in itsourcecode School Management System 1.0. This affects an unknown part of the file /student/index.phCVE-2026-05459.8In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basiCVE-2026-05469.8A vulnerability was determined in code-projects Content Management System 1.0. This impacts an unknown function of the file search.php. ThisCVE-2026-05478.8A vulnerability was found in PHPGurukul Online Course Registration up to 3.1. This issue affects some unknown processing of the file /admin/CVE-2026-05485.4The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missingCVE-2026-05496.4The Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'groups_group_info' shortcode in all versions CVE-2026-05506.4The myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mycred_load_coupon' shortcode in all versions
CVE-2026-0538: High severity, CVSS 8.4 | Vulnix