Read the docs
TI-2025-33016 Aliases CVE-2025-53012GHSA-qc2h-74x3-4v3w

MaterialX's Lack of Import Depth Limit Leads to DoS (Denial-Of-Service) Via Stack Exhaustion

Priority MEDIUM 64CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, nested imports of MaterialX files can lead to a crash via stack memory exhaustion, due to the lack of a limit on the "import chain" depth. When parsing file imports, recursion is used to process nested files; however, there is no limit imposed to the depth of files that can be parsed by the library. By building a sufficiently deep chain of MaterialX files one referencing the next, it is possible to crash the process using the MaterialX library via stack exhaustion. This is fixed in version 1.39.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00958 61st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed MaterialX (AcademySoftwareFoundation): 1.39.3MaterialX (PyPI): 1.39.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AcademySoftwareFoundationMaterialX1.39.2 to before 1.39.31.39.3Patch availableCNA
—MaterialX (PyPI)1.39.2 to before 1.39.31.39.3Patch availableGHSA-qc2h-74x3-4v3w
  • MaterialX VendorAcademySoftwareFoundation Affected 1.39.2 to before 1.39.3 Fixed in 1.39.3 Patch available CNA
  • MaterialX (PyPI) Vendor— Affected 1.39.2 to before 1.39.3 Fixed in 1.39.3 Patch available GHSA-qc2h-74x3-4v3w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:materialx:1.39.2:-:*:*:*:*:*:*1.39.2Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:materialx:1.39.2:-:*:*:*:*:*:* Versions 1.39.2 Vulnerable ·backstage

Remediation

  • Fix · CNA MaterialX (AcademySoftwareFoundation) Fixed in 1.39.3
  • Fix · GHSA-qc2h-74x3-4v3w MaterialX (PyPI) Fixed in 1.39.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-53012
  2. 2026-10-03 Alias added: GHSA-qc2h-74x3-4v3w

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2026-30739 OpenColorIO vulnerable to stack buffer overflow via unbounded `sscanf %s` in Spi3D (.spi3d) LUT parser CVSS 4.0HIGH 8.4
  • TI-2026-38605 OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS) CVSS 4.0HIGH 7.1
  • TI-2026-48281 OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union CVSS 3.1HIGH 7.1
  • TI-2026-48279 OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision CVSS 3.1HIGH 7.1
  • TI-2026-42768 OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindow CVSS 3.1HIGH 7.1
  • TI-2026-42338 OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin CVSS 3.1HIGH 7.1
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences