CVE-2009-3577

Autodesk 3ds Max 6-9 and 2008-2010 - Remote Code Execution via MAXScript DOSCommand Method

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-3577. PoCs published by Sebastian Tello.

AI-analyzed exploit summary This exploit leverages a vulnerability in Autodesk 3ds Max where arbitrary commands can be executed via a script callback. The PoC demonstrates command execution by launching calc.exe.

Description

Autodesk 3D Studio Max (3DSMax) 6 through 9 and 2008 through 2010 allows remote attackers to execute arbitrary code via a .max file with a MAXScript statement that calls the DOSCommand method, related to "application callbacks."

Exploits (1)

exploitdb WORKING POC VERIFIED
by Sebastian Tello · textremotewindows
https://www.exploit-db.com/exploits/33272

This exploit leverages a vulnerability in Autodesk 3ds Max where arbitrary commands can be executed via a script callback. The PoC demonstrates command execution by launching calc.exe.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Autodesk 3ds Max 6 through 9, 2008 through 2010
No auth needed
Prerequisites: Victim must open a malicious file or script in Autodesk 3ds Max
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1023230
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/36634
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/508012/100/0/threaded

Scores

EPSS 0.0423
EPSS Percentile 88.9%

Details

CWE
CWE-94
Status published
Products (7)
autodesk/3ds_max 6
autodesk/3ds_max 7
autodesk/3ds_max 8
autodesk/3ds_max 9
autodesk/3ds_max 2008
autodesk/3ds_max 2009
autodesk/3ds_max 2010
Published Nov 24, 2009
Tracked Since Feb 18, 2026