PT-2025-45726 · Pypi · Usd-Core

Publicado 2025-10-29 · Atualizado 2025-10-29

OSV

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Patch

This is fixed with commit b953092, with the fix available in OpenUSD 25.11 and onwards.

Summary

We have been advised by Zero Day Initiative that our usage of the USD framework may constitute a Use-After-Free Remote Code Execution Vulnerability. They have sent us the attached file illustrating the issue. Indeed, we see a use after free exception when running the file through our importer with an address sanitizer.

zdi-23709-poc0.zip

Thanks in advance.

Correção

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

GHSA-GRJP-54V3-C442

Produtos afetados

Usd-Core

Referências · 4

• https://github.com/PixarAnimationStudios/OpenUSD/security/advisories/GHSA-grjp-54v3-c442 · Nota
• https://github.com/PixarAnimationStudios/OpenUSD · Nota
• https://github.com/PixarAnimationStudios/OpenUSD/commit/b9530922b6a8ea72cd43661226b693fff8abbe4c · Nota
• https://osv.dev/vulnerability/GHSA-grjp-54v3-c442 · Aviso do Fabricante