Can a .3mf carry a virus?

Not in the way an .exe can. A .3mf is data, not a program: nothing in it runs by being on your disk. The real risk is a malformed file exploiting the slicer that opens it, and that has happened.

What can a hostile .3mf actually do?

It can carry input that breaks the program reading it. A .3mf is a ZIP of XML and vendor config, so opening one means handing a parser a file a stranger wrote.

• An external entity declaration makes the parser fetch something else while it reads: a local path, or a URL (XXE detection).
• A few lines of recursive entity definitions expand to gigabytes and exhaust the machine (XML bomb).
• A small archive can declare an enormous uncompressed size and do the same (compression bomb).
• A member name that is absolute, or that climbs with .., writes outside the folder it unpacks into (ZIP path traversal).

The worst case is a file carrying text the slicer itself runs.

What was CVE-2024-8374?

A .3mf that ran code when Bambu Studio opened it. Custom G-code embedded in a project file was executed on load, turning "open this model" into "run this on my machine". It is tracked at NVD as CVE-2024-8374, and the weakness class is CWE-94.

Bambu Studio fixed it. The patch did not remove the shape of the problem: a project file carries text a slicer will act on, and that is true of every slicer, not only the one with a CVE against it. Code injection has what preslice looks for.

What is worth checking before you slice?

The four above, plus executable patterns in the text members and the metadata, plus whether the package carries a signature part. Those six are what preslice checks, and each result names how many archive members it read.

Security lists all six with what each one looks for.

How do I check a file without opening it in a slicer?

Open it in a browser instead. Drop the file on preslice and the six checks run in the tab, before anything the file contains reaches a slicer. Nothing uploads and nothing in the file is executed.

A browser is built to open files from strangers safely. A slicer is not, because that has never been its job.

What does preslice not check?

Quite a lot. There is no antivirus scan: preslice looks for the structural patterns above and compares nothing against malware signatures. Signatures are reported and never verified, so it says whether an OPC signature part is present and makes no claim about who signed it or whether the file has changed since (Signature presence).

Geometry is out of scope: a mesh that is valid triangles but a terrible print is not a security question. Neither is what a slicer does with a value it reads. preslice can tell you a file sets a bed temperature of 400 and cannot tell you what your printer will do with that.

A check that read nothing proves nothing, and preslice says which case it is in. Where a member is too large to hold as text it states the fraction it read and names every member it skipped, rather than calling the file clean. The 3MF Core Specification defines the container these checks look at.