CVE-2025-53010: MaterialX Null Pointer Dereference Vulnerability in Shader Node Parsing
Summary
CVE-2025-53010: MaterialX Null Pointer Dereference in getShaderNodes due to Unchecked nodeGraph->getOutput return. Affects materialx versions >= 1.39.2, < 1.39.3. Fixed in 1.39.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MaterialX is an open-source library designed for the creation and manipulation of materials in 3D graphics applications. It provides a standardized way to define and share materials across different rendering engines. The library is widely used in visual effects and animation, allowing artists to create complex materials with ease. However, it has been found to have a vulnerability that can lead to crashes when processing maliciously crafted MTLX files.
Vulnerability Detail
The vulnerability arises in the MaterialX library when parsing shader nodes from MTLX files. Specifically, the function getShaderNodes in Material.cpp accesses a potentially null pointer when fetching output nodes from a node graph. If the node graph does not contain the requested output, the function returns a null pointer. Subsequent attempts to access methods on this null pointer can lead to crashes, making the application vulnerable to denial-of-service attacks when processing specially crafted files.
How To Fix
Latest published version: 1.39.5 as of 23 Oct 2026
pip install --upgrade "materialx==1.39.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.39.3
This is the first release that contains the fix.
pip install --upgrade "materialx==1.39.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that any MTLX files being processed are from trusted sources to avoid potential crashes. Additionally, you can implement checks in your application to validate the integrity of MTLX files before processing them.
Conclusion
The CVE-2025-53010 vulnerability in the MaterialX library poses a risk of application crashes when processing malicious MTLX files. It is crucial to update to the latest version to mitigate this risk and ensure the stability of applications using MaterialX.
See every vulnerability recorded for materialx →
FAQ
CVE-2025-53010 is a vulnerability in the MaterialX library that can lead to a null pointer dereference, causing crashes when processing malicious MTLX files.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground without any signup.
The CVSS score for this vulnerability is 2.0, indicating a low severity level.
If an immediate update is not possible, ensure that your application only processes MTLX files from trusted sources and implement validation checks on the files.
More information about MaterialX can be found on its official GitHub repository, where you can also access documentation and community support.
References
Related vulnerabilities
Recent vulnerabilities recorded for materialx.
