PT-2025-31590 · Openexr+1 · Openexr+1

Ndaprela + 3 · Published 2025-07-31 · Updated 2025-08-20 · CVE-2025-53009

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MaterialX versions 1.39.2 and below

Description MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. The MaterialX XML parsing logic can potentially crash due to stack exhaustion when parsing an MTLX file with multiple nested nodegraph implementations. An attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file.

Recommendations Update to version 1.39.3 or later.

Exploit

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2025-53009

GHSA-WX6G-FM6F-W822

Affected Products

Materialx

Openexr

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53009.json · Exploit
• 🔥 https://github.com/ShielderSec/poc/tree/main/CVE-2025-53009 · Exploit
• https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-wx6g-fm6f-w822 · Vendor Advisory
• https://github.com/AcademySoftwareFoundation/MaterialX/pull/2505 · Patch
• https://osv.dev/vulnerability/CVE-2025-53009 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wx6g-fm6f-w822 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53009 · Security Note
• https://github.com/AcademySoftwareFoundation/MaterialX/releases/tag/v1.39.3 · Note
• https://github.com/AcademySoftwareFoundation/MaterialX · Note
• https://github.com/AcademySoftwareFoundation/MaterialX/issues/2504 · Note
• https://twitter.com/dailycve/status/1951018172091634063 · Twitter Post
• https://twitter.com/CVEnew/status/1951349054622822489 · Twitter Post
• https://t.me/cveNotify/132953 · Telegram Post