---
id: CVE-2025-53009
aliases:
  - GHSA-wx6g-fm6f-w822
  - PYSEC-2026-1609
title: 'MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion Limit '
summary: 'MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion Limit '
severity: medium
vendor: materialx
product: materialx
ecosystem: pip
affected:
  - 'materialx >= 1.39.2, < 1.39.3'
patched:
  - materialx 1.39.3
published: '2025-07-31'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-wx6g-fm6f-w822'
references:
  - url: >-
      https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-wx6g-fm6f-w822
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-53009'
  - url: 'https://github.com/AcademySoftwareFoundation/MaterialX/issues/2504'
  - url: 'https://github.com/AcademySoftwareFoundation/MaterialX/pull/2505'
  - url: >-
      https://github.com/AcademySoftwareFoundation/MaterialX/commit/91ffea0de7bfe7bcd0c399b07f04fc48227055ff
  - url: 'https://github.com/AcademySoftwareFoundation/MaterialX'
  - url: >-
      https://github.com/AcademySoftwareFoundation/MaterialX/releases/tag/v1.39.3
  - url: 'https://github.com/ShielderSec/poc/tree/main/CVE-2025-53009'
tags:
  - osv
  - pip
epss: 0.00602
epssPercentile: 0.47536
ingestedAt: '2026-07-08T18:25:53.929Z'
---

## Overview

### Summary

When parsing an MTLX file with multiple nested `nodegraph` implementations, the MaterialX XML parsing logic can potentially crash due to stack exhaustion.

### Details

By specification, multiple kinds of elements in MTLX support nesting other elements, such as in the case of `nodegraph` elements. Parsing these subtrees is implemented via recursion, and since there is no max depth imposed on the XML document, this can lead to a stack overflow when the library parses an MTLX file with an excessively high number of nested elements.

### PoC

Please download the `recursion_overflow.mtlx` file from the following link: 

https://github.com/ShielderSec/poc/tree/main/CVE-2025-53009

`build/bin/MaterialXView --material recursion_overflow.mtlx`


### Impact
An attacker could intentionally crash a target program that uses MaterialX by sending a malicious MTLX file.

## Affected packages

- `materialx >= 1.39.2, < 1.39.3`

## Remediation

Upgrade to a patched release:

- `materialx 1.39.3`