{"id":"CVE-2025-53011","aliases":["GHSA-7qw8-3vmf-gj32","PYSEC-2026-1607"],"title":"MaterialX Null Pointer Dereference in MaterialXCore Shader Generation due to Unchecked implGraphOutput","summary":"MaterialX Null Pointer Dereference in MaterialXCore Shader Generation due to Unchecked implGraphOutput","severity":"low","vendor":"materialx","product":"materialx","ecosystem":"pip","affected":["materialx >= 1.39.2, < 1.39.3"],"patched":["materialx 1.39.3"],"published":"2025-07-31","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-7qw8-3vmf-gj32","references":[{"url":"https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-7qw8-3vmf-gj32"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53011"},{"url":"https://github.com/AcademySoftwareFoundation/MaterialX/commit/7ac1c71de5187dc29793292b5a8dc6d784192ecf"},{"url":"https://github.com/AcademySoftwareFoundation/MaterialX"},{"url":"https://github.com/AcademySoftwareFoundation/MaterialX/releases/tag/v1.39.3"},{"url":"https://github.com/ShielderSec/poc/tree/main/CVE-2025-53011"}],"tags":["osv","pip"],"epss":0.00516,"epssPercentile":0.42921,"ingestedAt":"2026-07-08T18:25:47.194Z","slug":"CVE-2025-53011","body":"## Overview\n\n### Summary\n\nWhen parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously crafted files.\n\n### Details\n\nIn `source/MaterialXCore/Material.cpp`, the following code extracts the output nodes for a given implementation graph:\n\n```cpp\n   InterfaceElementPtr impl = materialNodeDef->getImplementation();\n            if (impl && impl->isA<NodeGraph>())\n            {\n                NodeGraphPtr implGraph = impl->asA<NodeGraph>();\n                for (OutputPtr defOutput : materialNodeDef->getOutputs())\n                {\n                    if (defOutput->getType() == MATERIAL_TYPE_STRING)\n                    {\n                        OutputPtr implGraphOutput = implGraph->getOutput(defOutput->getName());\n                        for (GraphIterator it = implGraphOutput->traverseGraph().begin(); it != GraphIterator::end(); ++it)\n                        {\n                            ElementPtr upstreamElem = it.getUpstreamElement();\n                            if (!upstreamElem)\n                            {\n                                it.setPruneSubgraph(true);\n                                continue;\n                            }\n                            NodePtr upstreamNode = upstreamElem->asA<Node>();\n                            if (upstreamNode && upstream\n```\n\nHowever, when defining the `implGraphOutput` variable by getting the output node, the code doesn't check whether its value is null before accessing its iterator `traverseGraph()`. This leads to a potential null pointer dereference.\n\n### PoC\n\nPlease download `nullptr_implgraph.mtlx` from the following link:\n\nhttps://github.com/ShielderSec/poc/tree/main/CVE-2025-53011\n\n`build/bin/MaterialXView --material nullptr_implgraph.mtlx`\n\n### Impact\n\nAn attacker could intentionally crash a target program that uses MaterialX by sending a malicious MTLX file.\n\n## Affected packages\n\n- `materialx >= 1.39.2, < 1.39.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `materialx 1.39.3`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}