MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion Limit

Vulnerability

Overview

CVE-2025-53009 is a stack exhaustion flaw in the MaterialX XML parsing logic. In versions 1.39.2 and earlier, when parsing an MTLX file that contains multiple nested nodegraph implementations, the recursive parser can consume all available stack space, resulting in a crash [1][2]. The root cause is the lack of depth limits on nested `` elements during XML parsing.

Exploitation

An attacker can exploit this vulnerability by crafting a specially malformed MTLX file with deeply nested `` structures and convincing a target user or automated pipeline to open it. No authentication or special network position is required beyond the ability to supply the file to a MaterialX parser (e.g., the MaterialX Viewer or any application using the MaterialX library). The official CVE description states that the attack vector is local and does not require network access [3].

Impact

Successful exploitation leads to a denial-of-service (DoS) condition: the target application or service crashes abruptly. No data confidentiality or integrity is compromised, but availability is affected. The vulnerability is rated with a CVSS score indicating medium severity [3].

Mitigation

The issue is fixed in MaterialX version 1.39.3, released on or about August 21, 2025 [1]. Users should update to version 1.39.3 or later. No workarounds have been published; however, avoiding the parsing of untrusted MTLX files can reduce risk. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.