MaterialX's unchecked nodeGraph->getOutput return is vulnerable to NULL Pointer Dereference

Vulnerability

Details

In MaterialX 1.39.2, the getShaderNodes function in src/MaterialXCore/Material.cpp contains a null pointer dereference vulnerability. When parsing a nodegraph input node that has an explicit output string via input->hasOutputString(), the code calls nodeGraph->getOutput(input->getOutputString()) without checking if the returned pointer is null. If the specified output does not exist, the function returns a null pointer, which is then dereferenced when output->getConnectedNode() is called, leading to a crash [3][4].

Attack

Vector

The vulnerability can be triggered by supplying a specially crafted MTLX file where a nodegraph input references a non-existent output name. An attacker can send such a malicious MTLX file to any application that parses shader nodes using MaterialXCore, such as the MaterialX Viewer. No authentication is required; the attacker only needs to convince the target to process the file [1][3].

Impact

Successful exploitation causes a denial of service (DoS) by crashing the target program. The attacker does not gain code execution or data access, but the instability can disrupt workflows in content creation pipelines that depend on MaterialX [3].

Mitigation

The issue is fixed in MaterialX version 1.39.3 [1]. Users should upgrade to this or a later version. As of the publication date, there is no evidence that this CVE is listed in CISA’s Known Exploited Vulnerabilities catalog.