Vulnerability · Published Aug 1, 2025 · Assigned by GitHub_M

CVE-2025-53012MaterialX's Lack of Import Depth Limit Leads to DoS (Denial-Of-Service) Via Stack Exhaustion

Medium 5.5

In plain English

A medium-severity uncontrolled resource consumption in MaterialX from AcademySoftwareFoundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.5Medium

Exploit odds (30 days)1.0%top 38.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, nested imports of MaterialX files can lead to a crash via stack memory exhaustion, due to the lack of a limit on the "import chain" depth. When parsing file imports, recursion is used to process nested files; however, there is no limit imposed to the depth of files that can be parsed by the library. By building a sufficiently deep chain of MaterialX files one referencing the next, it is possible to crash the process using the MaterialX library via stack exhaustion. This is fixed in version 1.39.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	materialx	1.39.3	GHSA-qc2h-74x3-4v3w
PyPI	materialx	1.39.3	PYSEC-2026-1608

Affected products (as reported)

Vendor	Product	Versions
AcademySoftwareFoundation	MaterialX	>= 1.39.2, < 1.39.3

Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References