CVE-2025-53009: MaterialX Stack Overflow Due to Unbounded XML Parsing Recursion
Summary
CVE-2025-53009: MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion Limit. Affects materialx versions >= 1.39.2, < 1.39.3. Fixed in 1.39.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MaterialX is an open-source library designed for the creation and exchange of rich material and texture data. It is widely used in graphics applications to facilitate the sharing of material definitions across different rendering engines. The library supports various features, including nested node graphs, which allow for complex material representations. However, its XML parsing logic lacks a maximum recursion depth, making it vulnerable to stack exhaustion when processing deeply nested structures.
Vulnerability Detail
The vulnerability arises from the MaterialX XML parsing logic, which can crash due to stack exhaustion when parsing MTLX files with multiple nested 'nodegraph' implementations. This issue is rooted in the recursive parsing method used for handling nested elements without any imposed depth limit. An attacker can exploit this vulnerability by crafting a malicious MTLX file that contains an excessive number of nested elements, leading to a stack overflow and potentially crashing the application that utilizes the MaterialX library.
How To Fix
Minimum fixed version
1.39.3
This is the first release that contains the fix.
pip install --upgrade "materialx==1.39.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing MTLX files with deep nesting of elements until the package is updated. If you must process such files, consider validating the structure of the MTLX files to limit nesting depth.
Conclusion
CVE-2025-53009 highlights a significant vulnerability in the MaterialX library related to XML parsing. By understanding the nature of this vulnerability and following the recommended steps to update the package, users can protect their applications from potential crashes caused by malicious MTLX files.
See every vulnerability recorded for materialx →
FAQ
CVE-2025-53009 is a vulnerability in the MaterialX library that can lead to a stack overflow when parsing MTLX files with excessive nesting.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The primary impact is that an attacker could intentionally crash applications using MaterialX by sending a malicious MTLX file, leading to denial of service.
Yes, a patch is available in version 1.39.3 of the MaterialX package. Updating to this version will resolve the vulnerability.
If immediate updates are not possible, avoid processing deeply nested MTLX files and validate the structure of MTLX files to limit nesting depth.
References
Related vulnerabilities
Recent vulnerabilities recorded for materialx.
