MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion Limit
Summary
When parsing an MTLX file with multiple nested nodegraph implementations, the MaterialX XML parsing logic can potentially crash due to stack exhaustion.
Details
By specification, multiple kinds of elements in MTLX support nesting other elements, such as in the case of nodegraph elements. Parsing these subtrees is implemented via recursion, and since there is no max depth imposed on the XML document, this can lead to a stack overflow when the library parses an MTLX file with an excessively high number of nested elements.
PoC
Please download the recursion_overflow.mtlx file from the following link:
https://github.com/ShielderSec/poc/tree/main/CVE-2025-53009
build/bin/MaterialXView --material recursion_overflow.mtlx
Impact
An attacker could intentionally crash a target program that uses MaterialX by sending a malicious MTLX file.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | materialx | >= 1.39.2, < 1.39.3 | 1.39.3 |
References
- https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-wx6g-fm6f-w822
- https://nvd.nist.gov/vuln/detail/CVE-2025-53009
- https://github.com/AcademySoftwareFoundation/MaterialX/issues/2504
- https://github.com/AcademySoftwareFoundation/MaterialX/pull/2505
- https://github.com/AcademySoftwareFoundation/MaterialX/commit/91ffea0de7bfe7bcd0c399b07f04fc48227055ff
- https://github.com/AcademySoftwareFoundation/MaterialX
- https://github.com/AcademySoftwareFoundation/MaterialX/releases/tag/v1.39.3
- https://github.com/ShielderSec/poc/tree/main/CVE-2025-53009
- https://pypi.org/project/materialx
- https://github.com/advisories/GHSA-wx6g-fm6f-w822
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P- Weakness (CWE)
CWE-121- Platform
- Python (PyPI)
- Package
materialx- Disclosed
- 31.07.2025
- Updated
- 11.10.2026 13:19
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-1609 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-wx6g-fm6f-w822 - CC BY 4.0
Vulnerability history: materialx
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 07.2025 07.2025
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 2
- Low 2
Disclosures per year
- 2025: 4
- 2026: 0
-
MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion Limit this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.