CVE-2009-3576

no score yetEPSS 3.2%

Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents (aka .scntoc) file with a Script_Content element, as demonstrated by code that loads the WScript.Shell ActiveX control.

EPSS: 3.2% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2009-11-24
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

autodesk:autodesk_softimage
autodesk:autodesk_softimage_xsi

References

http://securitytracker.com/id?1023229
http://www.coresecurity.com/content/softimage-arbitrary-command-execution
http://www.securityfocus.com/archive/1/508011/100/0/threaded
http://www.securityfocus.com/bid/36637
http://securitytracker.com/id?1023229

Check your stack JSON