PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9303 Autodesk CVE debrief

CVE-2016-9303 is a critical memory-corruption issue in Autodesk FBX-SDK before 2017.1. According to the CVE/NVD record, malformed FBX format files can trigger multiple buffer overflows during reading or conversion, which may lead to arbitrary code execution or an infinite-loop condition.

Vendor
Autodesk
Product
CVE-2016-9303
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-25
Original CVE updated
2026-05-13
Advisory published
2017-01-25
Advisory updated
2026-05-13

Who should care

Security teams, developers, and product owners who ship or operate software that embeds or depends on Autodesk FBX-SDK, especially deployments still using versions up to 2017.0. Any workflow that imports or converts FBX files should treat this as high priority.

Technical summary

NVD maps the issue to Autodesk FBX Software Development Kit versions through 2017.0 inclusive and classifies the weakness as CWE-119. The published CVSS v3.0 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting a remotely triggerable, high-impact memory-corruption flaw. The CVE description states that malformed FBX files can cause multiple buffer overflows, with possible outcomes including arbitrary code execution or an infinite loop.

Defensive priority

Immediate. The combination of critical severity, no privileges required, no user interaction, and high CIA impact makes this a priority for patching, version validation, and exposure review wherever FBX content is accepted.

Recommended defensive actions

  • Upgrade Autodesk FBX-SDK to 2017.1 or later, or the first fixed version identified by Autodesk.
  • Inventory applications and services that bundle or depend on the FBX-SDK, including build pipelines and file-conversion services.
  • Restrict or sandbox processing of untrusted FBX files until remediation is complete.
  • Add file-type allowlisting, validation, and monitoring around FBX ingestion workflows.
  • Verify vendor guidance in the Autodesk security advisory referenced by the CVE/NVD record and align remediation with product-specific release notes.

Evidence notes

Based on the official CVE/NVD record and references. NVD lists Autodesk FBX Software Development Kit as vulnerable through version 2017.0 inclusive and classifies the weakness as CWE-119. The record references the Autodesk vendor advisory (adsk-sa-2016-01) and SecurityFocus BID 95805. The CVE was published on 2017-01-25; the 2026-05-13 modified timestamp reflects record maintenance, not the issue date.

Official resources

Publicly disclosed in the official CVE record on 2017-01-25. Use the CVE publication date for timeline context; the later 2026-05-13 modification is a record update.