CVE-2009-3576
Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary...
Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents (aka .scntoc) file with a Script_Content element, as demonstrated by code that loads the WScript.Shell ActiveX control.
Exploit likelihood
What each source reports
NVD Score used
Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents (aka .scntoc) file with a Script_Content element, as demonstrated by code that loads the WScript.Shell ActiveX control.
- Record
CVE-2009-3576- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents (aka .scntoc) file with a Script_Content element, as demonstrated by code that loads the WScript.Shell ActiveX control.
- Record
CVE-2009-3576- Updated
- 2026-11-02
EUVDEUVD-2009-3557 No score
Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents (aka .scntoc) file with a Script_Content element, as demonstrated by code that loads the WScript.Shell ActiveX control.
- Record
EUVD-2009-3557- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qv88-c9vm-fw8p No score
Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary...
Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents (aka .scntoc) file with a Script_Content element, as demonstrated by code that loads the WScript.Shell ActiveX control.
- Record
GHSA-qv88-c9vm-fw8p- Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Autodesk SoftImage Scene TOC - Arbitrary Command Execution | 2009-11-23 |
| Exploit-DB | Autodesk SoftImage 7.0 Scene - '.TOC' File Remote Code Execution | 2009-11-23 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3576 is a high vulnerability (CVSS 9.3) in Autodesk Softimage, published November 24, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.16%, the 88th percentile. No source names a fixed version.