GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GHSA-3JHF-GXHR-Q4CX

Vulnerability from github – Published: 2025-07-31 18:31 – Updated: 2025-08-01 18:36
VLAI
Summary
MaterialX Null Pointer Dereference in getShaderNodes due to Unchecked nodeGraph->getOutput return
Details

Summary

When parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously crafted files.

Details

In src/MaterialXCore/Material.cpp, in function getShaderNodes, the following code fetches the output nodes for a given nodegraph input node:

// SNIP...
        else if (input->hasNodeGraphString())
        {
            // Check upstream nodegraph connected to the input.
            // If no explicit output name given then scan all outputs on the nodegraph.
            ElementPtr parent = materialNode->getParent();
            NodeGraphPtr nodeGraph = parent->getChildOfType<NodeGraph>(input->getNodeGraphString());
            if (!nodeGraph)
            {
                continue;
            }
            vector<OutputPtr> outputs;
            if (input->hasOutputString())
            {
                outputs.push_back(nodeGraph->getOutput(input->getOutputString())); // <--- null ptr is returned
            }
            else
            {
                outputs = nodeGraph->getOutputs();
            }
            for (OutputPtr output : outputs)
            {
                NodePtr upstreamNode = output->getConnectedNode(); // <--- CRASHES HERE
                if (upstreamNode && !shaderNodeSet.count(upstreamNode))
                {
                    if (!target.empty() && !upstreamNode->getNodeDef(target))
                    {
                        continue;
                    }
                    shaderNodeVec.push_back(upstreamNode);
                    shaderNodeSet.insert(upstreamNode);
                }
            }
        }
    }
// SNIP...

The issues arise because the nodeGraph->getOutput(input->getOutputString()) call can return a null pointer, therefore when trying to call output->getConnectedNode(), this results in a crash .

PoC

Please download nullptr_getshadernodes.mltx from the following link:

https://github.com/ShielderSec/poc/tree/main/CVE-2025-53010

build/bin/MaterialXView --material nullptr_getshadernodes.mtlx

Impact

An attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file.

Severity
2.0 (Low)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "MaterialX"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.39.2"
            },
            {
              "fixed": "1.39.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.39.2"
      ]
    }
  ],
  "aliases": [
    "CVE-2025-53010"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-31T18:31:11Z",
    "nvd_published_at": "2025-08-01T18:15:54Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\nWhen parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously crafted files.\n\n### Details\n\nIn `src/MaterialXCore/Material.cpp`, in function `getShaderNodes`, the following code fetches the output nodes for a given `nodegraph` input node:\n\n```cpp\n// SNIP...\n        else if (input-\u003ehasNodeGraphString())\n        {\n            // Check upstream nodegraph connected to the input.\n            // If no explicit output name given then scan all outputs on the nodegraph.\n            ElementPtr parent = materialNode-\u003egetParent();\n            NodeGraphPtr nodeGraph = parent-\u003egetChildOfType\u003cNodeGraph\u003e(input-\u003egetNodeGraphString());\n            if (!nodeGraph)\n            {\n                continue;\n            }\n            vector\u003cOutputPtr\u003e outputs;\n            if (input-\u003ehasOutputString())\n            {\n                outputs.push_back(nodeGraph-\u003egetOutput(input-\u003egetOutputString())); // \u003c--- null ptr is returned\n            }\n            else\n            {\n                outputs = nodeGraph-\u003egetOutputs();\n            }\n            for (OutputPtr output : outputs)\n            {\n                NodePtr upstreamNode = output-\u003egetConnectedNode(); // \u003c--- CRASHES HERE\n                if (upstreamNode \u0026\u0026 !shaderNodeSet.count(upstreamNode))\n                {\n                    if (!target.empty() \u0026\u0026 !upstreamNode-\u003egetNodeDef(target))\n                    {\n                        continue;\n                    }\n                    shaderNodeVec.push_back(upstreamNode);\n                    shaderNodeSet.insert(upstreamNode);\n                }\n            }\n        }\n    }\n// SNIP...\n```\n\nThe issues arise because the `nodeGraph-\u003egetOutput(input-\u003egetOutputString())` call can return a null pointer, therefore when trying to call `output-\u003egetConnectedNode()`, this results in a crash    .\n\n\n### PoC\n\nPlease download `nullptr_getshadernodes.mltx` from the following link:\n\nhttps://github.com/ShielderSec/poc/tree/main/CVE-2025-53010\n\n`build/bin/MaterialXView --material nullptr_getshadernodes.mtlx`\n\n\n### Impact\n\nAn attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file.",
  "id": "GHSA-3jhf-gxhr-q4cx",
  "modified": "2025-08-01T18:36:02Z",
  "published": "2025-07-31T18:31:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-3jhf-gxhr-q4cx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53010"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AcademySoftwareFoundation/MaterialX/commit/e13344ba13326869d7820b444705f24d56fab73d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/AcademySoftwareFoundation/MaterialX"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ShielderSec/poc/tree/main/CVE-2025-53010"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "MaterialX Null Pointer Dereference in getShaderNodes due to Unchecked nodeGraph-\u003egetOutput return"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.