CVE-2025-53009 | BDVDB-2026-288231 Detail
AcademySoftwareFoundationMaterialX
Description#
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In versions 1.39.2 and below, when parsing an MTLX file with multiple nested nodegraph implementations, the MaterialX XML parsing logic can potentially crash due to stack exhaustion. An attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file. This is fixed in version 1.39.3.
Impact#
Per CVSS v4.0: confidentiality impact none, integrity impact none, availability impact low. Attack vector: network.
Weaknesses#
- CWE-121 Stack-based Buffer Overflow
References#
- https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-wx6g-fm6f-w822
- https://github.com/AcademySoftwareFoundation/MaterialX/issues/2504
- https://github.com/AcademySoftwareFoundation/MaterialX/pull/2505
- https://github.com/AcademySoftwareFoundation/MaterialX/releases/tag/v1.39.3
- https://github.com/ShielderSec/poc/tree/main/CVE-2025-53009
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.