Pixar OpenUSD Library Suffers Double Free Vulnerability Leading to RCE
A critical double-free vulnerability in Pixar's OpenUSD library, identified as CVE-2026-92211, allows for remote code execution.
Pixar Animation Studios' OpenUSD (Open Universal Scene Description) library, a widely used tool for 3D graphics and animation, has been found to contain a critical double-free vulnerability. This flaw, tracked as CVE-2026-92211, could allow remote attackers to execute arbitrary code on affected systems.
The vulnerability stems from an issue within the library's parsing of USDC and USDZ files. Specifically, the code fails to properly validate the existence of an object before attempting to free its memory. This can lead to a double-free condition, where the same memory region is freed twice, corrupting the program's memory management and potentially enabling an attacker to gain control of the process.
Exploiting this vulnerability requires user interaction, meaning an attacker cannot trigger it remotely without some form of user engagement. The exact attack vectors may vary depending on how OpenUSD is integrated into different applications. However, the potential for arbitrary code execution means that successful exploitation could lead to a complete compromise of the affected system, allowing attackers to run any code they desire.
The Common Vulnerability Scoring System (CVSS) has assigned this vulnerability a score of 7.8, classifying it as High severity. This score reflects the potential impact and the relative ease with which it could be exploited, despite the interaction requirement.
Pixar Animation Studios has addressed this vulnerability by releasing an update to the OpenUSD library. The fix, detailed in a GitHub commit, aims to correct the improper memory handling that leads to the double-free condition. Users and developers relying on OpenUSD are strongly advised to update to the patched version as soon as possible to mitigate the risk.
The disclosure timeline indicates that the vulnerability was reported to the vendor on April 15, 2026, and the coordinated public release of the advisory occurred on October 26, 2026. This six-month period allowed Pixar sufficient time to develop and distribute a fix before the vulnerability became widely known.
This vulnerability was discovered by Brandon Evans of TrendAI Zero Day Initiative, highlighting the ongoing efforts of security researchers to uncover and report critical flaws in widely used software libraries. The discovery and subsequent patching of such vulnerabilities are crucial for maintaining the security and integrity of the digital content creation pipeline.
The OpenUSD library is integral to many professional 3D workflows, and a vulnerability like this could have significant implications for studios and individuals using the software. Prompt patching is essential to prevent potential exploitation by malicious actors.