NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐍 PyPI
Not in CISA KEV

MaterialX Null Pointer Dereference in MaterialXCore Shader Generation due to Unchecked implGraphOutputGHSA-7qw8-3vmf-gj32

Fix: AcademySoftwareFoundation/MaterialX@7ac1c71

GHSA-7qw8-3vmf-gj32 is a NULL Pointer Dereference vulnerability in materialx. A fix is available for materialx — see the affected versions and patch details below.

Also known asCVE-2025-53011PYSEC-2026-1607
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 4, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.

Exploitation and automatability from CISA’s SSVC triage for GHSA-7qw8-3vmf-gj32.

EPSS Exploitation Probability

via FIRST.org ↗
0.6%probability of exploitation in next 30 days
Lower Risk+0.04%
Lower risk than most CVEs49th percentile — riskier than 49% of all scored CVEsHighest risk
0.00%0.37%0.74%1.11%0.1%0.6%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

1 pkg affected
🐍materialx

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Summary

When parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously crafted files.

Details

In source/MaterialXCore/Material.cpp, the following code extracts the output nodes for a given implementation graph:

   InterfaceElementPtr impl = materialNodeDef->getImplementation();
            if (impl && impl->isA<NodeGraph>())
            {
                NodeGraphPtr implGraph = impl->asA<NodeGraph>();
                for (OutputPtr defOutput : materialNodeDef->getOutputs())
                {
                    if (defOutput->getType() == MATERIAL_TYPE_STRING)
                    {
                        OutputPtr implGraphOutput = implGraph->getOutput(defOutput->getName());
                        for (GraphIterator it = implGraphOutput->traverseGraph().begin(); it != GraphIterator::end(); ++it)
                        {
                            ElementPtr upstreamElem = it.getUpstreamElement();
                            if (!upstreamElem)
                            {
                                it.setPruneSubgraph(true);
                                continue;
                            }
                            NodePtr upstreamNode = upstreamElem->asA<Node>();
                            if (upstreamNode && upstream

However, when defining the implGraphOutput variable by getting the output node, the code doesn't check whether its value is null before accessing its iterator traverseGraph(). This leads to a potential null pointer dereference.

PoC

Please download nullptr_implgraph.mtlx from the following link:

https://github.com/ShielderSec/poc/tree/main/CVE-2025-53011

build/bin/MaterialXView --material nullptr_implgraph.mtlx

Impact

An attacker could intentionally crash a target program that uses MaterialX by sending a malicious MTLX file.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPImaterialx≥ 1.39.2&&< 1.39.31.39.3pip install --upgrade 'materialx==1.39.3'

Affected Products

1 product · 1 configurations
Application
materialxlinuxfoundation
1 version
1.39.2

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for materialx, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update materialx to 1.39.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-7qw8-3vmf-gj32 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Summary When parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously crafted files. ### Details In `source/MaterialXCore/Material.cpp`, the following code extracts the output nodes for a given implementation graph: ```cpp InterfaceElementPtr impl = materialNodeDef->getImplementation(); if (impl && impl->isA<NodeGraph>()) { NodeGraphPtr implGraph = impl->asA<NodeGraph>(); for (OutputPtr defOutput : materialNodeDef->getOutputs()) {
O3 Security · Impact-Aware SCA

Is GHSA-7qw8-3vmf-gj32 in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
MaterialX Null Pointer Dereference in MaterialXCore…