{"id":"CVE-2026-0659","summary":"USD File Parsing Out-of-Bounds Write Vulnerability","details":"A maliciously crafted USD file, when loaded or imported into Autodesk Arnold or Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.","modified":"2026-11-05T08:04:05.543668221Z","published":"2026-02-04T16:01:27.307Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"range":[{"introduced":"2026.2"},{"fixed":"2026.3.2"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]}],"cna_assigner":"autodesk","cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0659.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0659.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0659"},{"type":"ADVISORY","url":"https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0003"},{"type":"FIX","url":"https://github.com/Autodesk/arnold-usd"},{"type":"FIX","url":"https://www.autodesk.com/products/autodesk-access/overview"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/autodesk/arnold-usd","events":[{"introduced":"ebb09c83a0a62286b06570ffb6d844b9c3be1908"},{"fixed":"fd7f918af915e0c03a2d754f5c29e251abbf76b9"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"7.4.4.1"},{"fixed":"7.4.4.2"}],"source":"AFFECTED_FIELD"}]}}],"versions":["Arnold-7.4.4.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-0659.json","vanir_signatures":[{"digest":{"function_hash":"33172460119592856391752310482612514714","length":6775},"id":"CVE-2026-0659-07fb3242","signature_type":"Function","signature_version":"v1","source":"https://github.com/autodesk/arnold-usd/commit/fd7f918af915e0c03a2d754f5c29e251abbf76b9","target":{"file":"libs/render_delegate/render_delegate.cpp","function":"HdArnoldRenderDelegate::_SetRenderSetting"},"deprecated":false},{"id":"CVE-2026-0659-968ac892","signature_type":"Line","signature_version":"v1","source":"https://github.com/autodesk/arnold-usd/commit/fd7f918af915e0c03a2d754f5c29e251abbf76b9","target":{"file":"libs/render_delegate/render_delegate.cpp"},"deprecated":false,"digest":{"line_hashes":["97150224264877145042112521929030155310","273158015898495007198136682669539470917","333101043010808626504067165469580221182","84718799072710597556920164615729854813"],"threshold":0.9}},{"target":{"file":"libs/render_delegate/render_delegate.h"},"deprecated":false,"digest":{"line_hashes":["282977699507371547057028864442417344653","67237973323436846106366256894782904860","33342310093652445909074404622268174176","41687586081659567331900645828442252482"],"threshold":0.9},"id":"CVE-2026-0659-adae8d60","signature_type":"Line","signature_version":"v1","source":"https://github.com/autodesk/arnold-usd/commit/fd7f918af915e0c03a2d754f5c29e251abbf76b9"}],"vanir_signatures_modified":"2026-11-05T08:04:05Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}