Merge pull request #7658 from github/three-star-potato-GHSA-wx6g-fm6f-w822

Author: advisory-database[bot]

advisories/github-reviewed/2025/08/GHSA-wx6g-fm6f-w822/GHSA-wx6g-fm6f-w822.json

@@ -0,0 +1,84 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wx6g-fm6f-w822",
+  "modified": "2025-08-01T18:35:58Z",
+  "published": "2025-07-31T19:37:48Z",
+  "aliases": [
+    "CVE-2025-53009"
+  ],
+  "summary": "MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion Limit ",
+  "details": "### Summary\n\nWhen parsing an MTLX file with multiple nested `nodegraph` implementations, the MaterialX XML parsing logic can potentially crash due to stack exhaustion.\n\n### Details\n\nBy specification, multiple kinds of elements in MTLX support nesting other elements, such as in the case of `nodegraph` elements. Parsing these subtrees is implemented via recursion, and since there is no max depth imposed on the XML document, this can lead to a stack overflow when the library parses an MTLX file with an excessively high number of nested elements.\n\n### PoC\n\nPlease download the `recursion_overflow.mtlx` file from the following link: \n\nhttps://github.com/ShielderSec/poc/tree/main/CVE-2025-53009\n\n`build/bin/MaterialXView --material recursion_overflow.mtlx`\n\n\n### Impact\nAn attacker could intentionally crash a target program that uses MaterialX by sending a malicious MTLX file.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "MaterialX"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.39.2"
+            },
+            {
+              "fixed": "1.39.3"
+            }
+          ]
+        }
+      ],
+      "versions": [
+        "1.39.2"
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-wx6g-fm6f-w822"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53009"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/AcademySoftwareFoundation/MaterialX/issues/2504"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/AcademySoftwareFoundation/MaterialX/pull/2505"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/AcademySoftwareFoundation/MaterialX/commit/defc03b7aca865d7e71a9197da9351d3f5ea8786"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/AcademySoftwareFoundation/MaterialX"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/AcademySoftwareFoundation/MaterialX/releases/tag/v1.39.3"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/ShielderSec/poc/tree/main/CVE-2025-53009"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-121"
+    ],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-07-31T19:37:48Z",
+    "nvd_published_at": "2025-08-01T18:15:54Z"
+  }
+}