PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9305 Autodesk CVE debrief

CVE-2016-9305 is a critical vulnerability in Autodesk FBX-SDK versions before 2017.1. According to the NVD record and Autodesk advisory reference, malformed FBX files can trigger improper handling of type mismatches and previously deleted objects, which may expose uninitialized pointers. The NVD classifies the issue as high-severity network-reachable exposure with no privileges or user interaction required, and assigns a CVSS 3.0 score of 9.8.

Vendor
Autodesk
Product
CVE-2016-9305
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-25
Original CVE updated
2026-05-13
Advisory published
2017-01-25
Advisory updated
2026-05-13

Who should care

Organizations and developers that embed Autodesk FBX-SDK, process FBX content, or distribute software that imports, converts, validates, or renders FBX files should treat this as high priority. This includes product teams, content pipeline operators, and security teams responsible for third-party library patching and file-ingestion controls.

Technical summary

NVD describes the flaw as improper handling in Autodesk FBX-SDK before 2017.1 when reading and converting malformed FBX files. The vulnerable code path involves type mismatches and previously deleted objects, which can lead to access to uninitialized pointers. NVD maps the weakness to CWE-19 and lists the affected CPE as Autodesk FBX Software Development Kit through version 2017.0 inclusive.

Defensive priority

Critical. The combination of network exposure, no required privileges, no user interaction, and high CVSS impact means this should be prioritized alongside any component that parses untrusted FBX content.

Recommended defensive actions

  • Upgrade Autodesk FBX-SDK to version 2017.1 or later.
  • Inventory all applications, plugins, services, and build pipelines that use FBX-SDK or ingest FBX files.
  • Treat FBX files from untrusted or external sources as high-risk input and apply strict validation and isolation controls.
  • Rebuild and redeploy downstream products after upgrading the SDK to ensure the vulnerable library is no longer bundled.
  • Review vendor advisory guidance and confirm whether any packaged products or third-party tools depend on affected SDK versions.

Evidence notes

Source evidence is limited to the official NVD record and the referenced Autodesk security advisory. NVD identifies the affected product as Autodesk FBX Software Development Kit through 2017.0 inclusive, the weakness as CWE-19, and the CVSS 3.0 vector as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVE was published on 2017-01-25 and later modified by NVD on 2026-05-13; that modification date is used only as record-timeline context, not as the vulnerability date.

Official resources

Publicly disclosed and published in the CVE record on 2017-01-25. NVD record metadata was modified on 2026-05-13.