CVE-2025-53010: MaterialX Null Pointer Dereference in getShaderNodes
Summary
CVE-2025-53010: MaterialX Null Pointer Dereference in getShaderNodes due to Unchecked nodeGraph->getOutput return. Affects materialx versions >= 1.39.2, < 1.39.3. Fixed in 1.39.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MaterialX is an open-source library designed for the creation and manipulation of 3D materials and shaders. It provides a flexible framework for defining complex material properties and is widely used in graphics applications. The library's ability to parse and manage shader nodes is crucial for rendering realistic materials. However, a vulnerability has been identified that could lead to application crashes when processing maliciously crafted MTLX files.
Vulnerability Detail
The vulnerability arises from a null pointer dereference in the MaterialXCore code when parsing shader nodes in a MTLX file. Specifically, the function getShaderNodes accesses a potentially null pointer returned by nodeGraph->getOutput(input->getOutputString()). If this pointer is null, subsequent calls to output->getConnectedNode() will result in a crash. This vulnerability can be exploited by attackers to intentionally crash applications that utilize the MaterialX library, leading to denial of service.
How To Fix
Latest published version: 1.39.5 as of 23 Oct 2026
pip install --upgrade "materialx==1.39.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.39.3
This is the first release that contains the fix.
pip install --upgrade "materialx==1.39.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing MTLX files from untrusted sources. Implement additional validation checks in your application to ensure that the shader nodes are correctly defined before attempting to access their properties.
Conclusion
The CVE-2025-53010 vulnerability in the MaterialX library poses a risk of application crashes due to null pointer dereferences when processing MTLX files. Users are encouraged to update to the latest version to mitigate this risk and to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their software.
See every vulnerability recorded for materialx →
FAQ
CVE-2025-53010 is a vulnerability in the MaterialX library that allows for a null pointer dereference, potentially leading to application crashes when processing malformed MTLX files.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
Exploiting this vulnerability can lead to application crashes, resulting in denial of service for users relying on the MaterialX library for rendering materials.
Yes, the vulnerability has been patched in version 1.39.3 of the MaterialX library. Users are advised to update to this version or later.
If an immediate update is not possible, implement validation checks on MTLX files to ensure they are safe to process, and avoid using files from untrusted sources.
References
Related vulnerabilities
Recent vulnerabilities recorded for materialx.
