Read the docs
TI-2025-33013 Aliases CVE-2025-53009GHSA-wx6g-fm6f-w822

MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion Limit

Priority MEDIUM 64CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In versions 1.39.2 and below, when parsing an MTLX file with multiple nested nodegraph implementations, the MaterialX XML parsing logic can potentially crash due to stack exhaustion. An attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file. This is fixed in version 1.39.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00715 53rd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed MaterialX (AcademySoftwareFoundation): 1.39.3MaterialX (PyPI): 1.39.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AcademySoftwareFoundationMaterialX1.39.2 to before 1.39.31.39.3Patch availableCNA
—MaterialX (PyPI)1.39.2 to before 1.39.31.39.3Patch availableGHSA-wx6g-fm6f-w822
  • MaterialX VendorAcademySoftwareFoundation Affected 1.39.2 to before 1.39.3 Fixed in 1.39.3 Patch available CNA
  • MaterialX (PyPI) Vendor— Affected 1.39.2 to before 1.39.3 Fixed in 1.39.3 Patch available GHSA-wx6g-fm6f-w822

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:materialx:1.39.2:-:*:*:*:*:*:*1.39.2Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:materialx:1.39.2:-:*:*:*:*:*:* Versions 1.39.2 Vulnerable ·backstage

Remediation

  • Fix · CNA MaterialX (AcademySoftwareFoundation) Fixed in 1.39.3
  • Fix · GHSA-wx6g-fm6f-w822 MaterialX (PyPI) Fixed in 1.39.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-53009
  2. 2026-10-03 Alias added: GHSA-wx6g-fm6f-w822
  3. 2026-10-23 EPSS moved to the 50th–90th percentile

References

Exploit 2

Patch 1

Advisory 1

Other 4

  • TI-2026-30739 OpenColorIO vulnerable to stack buffer overflow via unbounded `sscanf %s` in Spi3D (.spi3d) LUT parser CVSS 4.0HIGH 8.4
  • TI-2026-38605 OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS) CVSS 4.0HIGH 7.1
  • TI-2026-48281 OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union CVSS 3.1HIGH 7.1
  • TI-2026-48279 OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision CVSS 3.1HIGH 7.1
  • TI-2026-42768 OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindow CVSS 3.1HIGH 7.1
  • TI-2026-42338 OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin CVSS 3.1HIGH 7.1
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences