CVE-2025-53009: AcademySoftwareFoundation MaterialX stack overflow in XML parsing

Executive brief

MaterialX is an open-source library used for describing and sharing rich visual materials in computer graphics and film production. A vulnerability in how the library handles complex files could allow an attacker to crash applications that use this software. By providing a specially crafted material file with excessive nesting, an attacker can cause a service outage or application failure, potentially disrupting production workflows.

Technical details

A stack-based buffer overflow (CWE-121) exists in MaterialX version 1.39.2 due to a lack of recursion depth limits during XML parsing. The library uses recursive functions to process nested elements like 'nodegraph' within MTLX files. An attacker can provide a malicious MTLX file containing an excessively high number of nested elements to exhaust the stack memory, resulting in a crash (denial of service). The issue is reachable over the network if an application accepts and parses untrusted MTLX files. This vulnerability is addressed in version 1.39.3.

Affected products

• AcademySoftwareFoundation MaterialX 1.39.2

Timeline

• 2025-07-31: disclosed
• 2025-07-31: advisory
• 2025-07-31: patched: Fixed in version 1.39.3

References

• https://api.github.com/users/suidpit
• https://github.com/suidpit
• https://api.github.com/users/suidpit/gists%7B/gist_id%7D
• https://api.github.com/users/suidpit/repos
• https://avatars.githubusercontent.com/u/25264901?v=4
• https://api.github.com/users/suidpit/events%7B/privacy%7D