Secunia has announced a vulnerability found in Convex 3D, the converter, viewer, and object extractor for 3D file formats such as 3DS, Wavefront OBJ, and Lightwave 3D. The vulnerability was reported in version 0.8pre1, but prior versions may also be affected.

Secunia Advisory SA 13530 states, “The vulnerability is caused due to a boundary error in the "readObjectChunk()" function, which is used when handling 3DS files. This can be exploited to cause a buffer overflow via a specially crafted 3DS document.”

Successful exploitation of this vulnerability allows the execution of arbitrary code, but it also requires that you be tricked into opening a malicious 3DS document. Accordingly, Secunia recommends that you not open 3DS files from untrusted sources when you are using Convex3D.