CVE-2025-53012: MaterialX Stack Exhaustion Vulnerability Due to Lack of Import Depth Limit
Summary
CVE-2025-53012: MaterialX Lack of MTLX Import Depth Limit Leads to DoS (Denial-Of-Service) Via Stack Exhaustion. Affects materialx versions >= 1.39.2, < 1.39.3. Fixed in 1.39.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MaterialX is an open-source library designed for the interchange of 3D graphics data, allowing users to define and share materials across different rendering engines. It supports complex material definitions and nested imports through XInclude tags, enabling a flexible and powerful way to manage material assets. However, this flexibility also introduces vulnerabilities, particularly when it comes to handling deeply nested imports.
Vulnerability Detail
The vulnerability arises from the absence of a limit on the depth of nested imports in MaterialX files. When parsing these files, the library uses recursion to process imports, which can lead to stack memory exhaustion if an attacker creates a sufficiently deep chain of imports. This can cause applications using the MaterialX library to crash, resulting in a Denial of Service (DoS). The vulnerability is particularly concerning in Windows environments, where attackers can exploit it by controlling the content of a single .mtlx file that references remote paths via UNC notation.
How To Fix
Latest published version: 1.39.5 as of 23 Oct 2026
pip install --upgrade "materialx==1.39.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.39.3
This is the first release that contains the fix.
pip install --upgrade "materialx==1.39.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using deeply nested imports in MaterialX files. Limit the number of imports and ensure that the structure of your MaterialX files does not create excessively deep chains.
Conclusion
The CVE-2025-53012 vulnerability in the MaterialX library poses a significant risk due to the lack of limits on nested imports, leading to potential stack exhaustion and application crashes. Users are advised to update to the latest version to mitigate this risk and consider using Vulert for ongoing monitoring of vulnerabilities.
See every vulnerability recorded for materialx →
FAQ
CVE-2025-53012 is a vulnerability in the MaterialX library that allows for stack exhaustion due to unlimited nested imports in MaterialX files.
Exploiting this vulnerability can lead to application crashes and Denial of Service, particularly if an attacker can control the content of MaterialX files.
Versions prior to 1.39.3 are affected by this vulnerability. It is recommended to upgrade to version 1.39.3 or later.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate upgrade is not possible, limit the use of nested imports in your MaterialX files as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for materialx.
