High severity · published Aug 1, 2025
CVE-2025-53009
MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion Limit
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In versions 1.39.2 and below, when parsing an MTLX file with multiple nested nodegraph implementations, the MaterialX XML parsing logic can potentially crash due to stack exhaustion. An attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file. This is fixed in version 1.39.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
MaterialX · AcademySoftwareFoundation
>= 1.39.2, < 1.39.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-53009
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-53009
Issue Tracking
https://github.com/AcademySoftwareFoundation/MaterialX/issues/2504
Issue Tracking
https://github.com/AcademySoftwareFoundation/MaterialX/pull/2505
Release Notes
https://github.com/AcademySoftwareFoundation/MaterialX/releases/tag/v1.39.3
Exploit
https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-wx6g-fm6f-w822
Exploit
https://github.com/ShielderSec/poc/tree/main/CVE-2025-53009
More from MaterialX
7.5
CVE-2025-53012
MaterialX's Lack of Import Depth Limit Leads to DoS (Denial-Of-Service) Via Stack Exhaustion
7.5
CVE-2025-53011
MaterialX is Vulnerable to NULL Pointer Dereference due to Unchecked implGraphOutput
7.5
CVE-2025-53010
MaterialX's unchecked nodeGraph->getOutput return is vulnerable to NULL Pointer Dereference