CVE-2025-53012: academysoftwarefoundation materialx Uncontrolled Resource Consumption

Vulnerability summary

CVE-2025-53012 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in academysoftwarefoundation materialx. EPSS estimates a 0.85% chance of exploitation in the next 30 days, higher than 57.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 01-08-2025
   PublishedVulnerability first disclosed.
2. 01-08-2025
   Last modifiedVulnerability information updated.

Description

MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, nested imports of MaterialX files can lead to a crash via stack memory exhaustion, due to the lack of a limit on the "import chain" depth. When parsing file imports, recursion is used to process nested files; however, there is no limit imposed to the depth of files that can be parsed by the library. By building a sufficiently deep chain of MaterialX files one referencing the next, it is possible to crash the process using the MaterialX library via stack exhaustion. This is fixed in version 1.39.3.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.