MaterialX's Lack of Import Depth Limit Leads to DoS (Denial-Of-Service) Via Stack Exhaustion

Vulnerability

MaterialX, an open standard for material exchange, supports importing files via XInclude. In versions prior to 1.39.3, the parser recursively processes nested imports without any depth limit, leading to stack memory exhaustion when a deeply nested chain of files is parsed [2].

Exploitation

An attacker can craft a sequence of MaterialX files that reference one another in a deep chain. If a victim parses a malicious .mtlx file (e.g., via MaterialXView), the recursion can exhaust the stack, crashing the application. On Windows, an attacker could host the chain on a network share to trigger the vulnerability [2].

Impact

Successful exploitation causes a denial-of-service (DoS) via process crash. No authentication or special privileges are required, as the vulnerability is triggered during parsing [3].

Mitigation

The issue is fixed in MaterialX 1.39.3 by introducing MAX_XINCLUDE_DEPTH and MAX_XML_TREE_DEPTH constants (both set to 256) to limit recursion depth [4]. Users should upgrade to version 1.39.3 or later.