{"id":"CVE-2025-53011","aliases":["GHSA-7qw8-3vmf-gj32","PYSEC-2026-1607"],"url":"https://o3.security/vulnerability/CVE-2025-53011","summary":"MaterialX is Vulnerable to NULL Pointer Dereference due to Unchecked implGraphOutput","details":"### Summary\n\nWhen parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously crafted files.\n\n### Details\n\nIn `source/MaterialXCore/Material.cpp`, the following code extracts the output nodes for a given implementation graph:\n\n```cpp\n   InterfaceElementPtr impl = materialNodeDef->getImplementation();\n            if (impl && impl->isA<NodeGraph>())\n            {\n                NodeGraphPtr implGraph = impl->asA<NodeGraph>();\n                for (OutputPtr defOutput : materialNodeDef->getOutputs())\n                {\n                    if (defOutput->getType() == MATERIAL_TYPE_STRING)\n                    {\n                        OutputPtr implGraphOutput = implGraph->getOutput(defOutput->getName());\n                        for (GraphIterator it = implGraphOutput->traverseGraph().begin(); it != GraphIterator::end(); ++it)\n                        {\n                            ElementPtr upstreamElem = it.getUpstreamElement();\n                            if (!upstreamElem)\n                            {\n                                it.setPruneSubgraph(true);\n                                continue;\n                            }\n                            NodePtr upstreamNode = upstreamElem->asA<Node>();\n                            if (upstreamNode && upstream\n```\n\nHowever, when defining the `implGraphOutput` variable by getting the output node, the code doesn't check whether its value is null before accessing its iterator `traverseGraph()`. This leads to a potential null pointer dereference.\n\n### PoC\n\nPlease download `nullptr_implgraph.mtlx` from the following link:\n\nhttps://github.com/ShielderSec/poc/tree/main/CVE-2025-53011\n\n`build/bin/MaterialXView --material nullptr_implgraph.mtlx`\n\n### Impact\n\nAn attacker could intentionally crash a target program that uses MaterialX by sending a malicious MTLX file.","published":"2025-08-01T17:58:47.388Z","modified":"2026-08-12T03:51:38.366295531Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"materialx","fixedVersion":"1.39.3"}],"fix":{"url":"https://github.com/AcademySoftwareFoundation/MaterialX/commit/7ac1c71de5187dc29793292b5a8dc6d784192ecf","label":"AcademySoftwareFoundation/MaterialX@7ac1c71"},"references":[{"type":"WEB","url":"https://github.com/AcademySoftwareFoundation/MaterialX/releases/tag/v1.39.3"},{"type":"WEB","url":"https://github.com/ShielderSec/poc/tree/main/CVE-2025-53011"},{"type":"ADVISORY","url":"https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-7qw8-3vmf-gj32"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53011.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53011"},{"type":"FIX","url":"https://github.com/AcademySoftwareFoundation/MaterialX/commit/7ac1c71de5187dc29793292b5a8dc6d784192ecf"},{"type":"PACKAGE","url":"https://github.com/AcademySoftwareFoundation/MaterialX"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:38.366295531Z"}}