High severity · published Aug 1, 2025
CVE-2025-53012
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, nested imports of MaterialX files can lead to a crash via stack memory exhaustion, due to the lack of a limit on the "import chain" depth. When parsing file imports, recursion is used to process nested files; however, there is no limit imposed to the depth of files that can be parsed by the library. By building a sufficiently deep chain of MaterialX files one referencing the next, it is possible to crash the process using the MaterialX library via stack exhaustion. This is fixed in version 1.39.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Materialx · Linuxfoundation
1.39.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-53012
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-53012
Product
https://github.com/AcademySoftwareFoundation/MaterialX/blob/main/documents/Specification/MaterialX.Specification.md#mtlx-file-format-definition
Patch
https://github.com/AcademySoftwareFoundation/MaterialX/pull/2233/commits/6182c07467297416a30d148ab531d81198686dc5
Release Notes
https://github.com/AcademySoftwareFoundation/MaterialX/releases/tag/v1.39.3
Exploit
https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-qc2h-74x3-4v3w
More from Materialx
7.5
CVE-2025-53011
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers
7.5
CVE-2025-53010
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers
7.5
CVE-2025-53009
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers
