MaterialX’s Lack of Import Depth Limit Leads to DoS (Denial-Of-Service) Via Stack Exhaustion

Basic Information

Title	MaterialX’s Lack of Import Depth Limit Leads to DoS (Denial-Of-Service) Via Stack Exhaustion
Type	cve
Published	2025-08-01T18:00:39.115Z
Modified	2025-08-01T19:04:41.209Z

Product Information

Vendor	AcademySoftwareFoundation
Product	MaterialX
Version	>= 1.39.2, < 1.39.3

MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, nested imports of MaterialX files can lead to a crash via stack memory exhaustion, due to the lack of a limit on the “import chain” depth. When parsing file imports, recursion is used to process nested files; however, there is no limit imposed to the depth of files that can be parsed by the library. By building a sufficiently deep chain of MaterialX files one referencing the next, it is possible to crash the process using the MaterialX library via stack exhaustion. This is fixed in version 1.39.3.