CVE-2025-53009 json
MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion Limit
published 2025-07-31 15 mo ago modified 2026-07-07 4 mo ago also GHSA-wx6g-fm6f-w822 , PYSEC-2026-1609 , EUVD-2025-23382
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In versions 1.39.2 and below, when parsing an MTLX file with multiple nested nodegraph implementations, the MaterialX XML parsing logic can potentially crash due to stack exhaustion. An attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file. This is fixed in version 1.39.3.
Patch / fix
- pypi materialx 1.39.3
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 15 mo ago
Exploit prediction
0.71% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-wx6g-fm6f-w822 referenced PoC, tagged "exploit" by a source, unverified
- github.com https://github.com/ShielderSec/poc/tree/main/CVE-2025-53009 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.5 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P |
| CNA | 4.0 | 5.5 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | materialx | >=1.39.2, <1.39.3 |
1.39.3 |
Affected products
- AcademySoftwareFoundation MaterialX
Classification
- Weakness
-
- CWE-121 Stack-based Buffer Overflow
References
-
github.com
/AcademySoftwareFoundation/MaterialX/pull/2505
web, issue-tracking, patch
-
github.com
/AcademySoftwareFoundation/MaterialX/commit/91ffea0de7bfe7bcd0c399b07f04fc48227055ff
web
-
github.com
/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-wx6g-fm6f-w822
web, exploit, vendor-advisory
-
github.com
/ShielderSec/poc/tree/main/CVE-2025-53009
web, exploit
-
github.com
/AcademySoftwareFoundation/MaterialX/issues/2504
web, issue-tracking
-
github.com
/AcademySoftwareFoundation/MaterialX/releases/tag/v1.39.3
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2025-53009
advisory
-
github.com
/AcademySoftwareFoundation/MaterialX
package
-
pypi.org
/project/materialx
package
-
github.com
/advisories/GHSA-wx6g-fm6f-w822
advisory
Sources
- CVE List CVE-2025-53009
- GitHub Advisory GHSA-wx6g-fm6f-w822
- NVD CVE-2025-53009
- OSV PYSEC-2026-1609
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.