Listen to this Post
How the CVE Works
The vulnerability occurs in MaterialXCore when parsing shader nodes from an MTLX file. In Material.cpp, the function `getShaderNodes` retrieves output nodes from a nodegraph input. If `nodeGraph->getOutput(input->getOutputString())` returns a null pointer (due to a maliciously crafted file), subsequent access via `output->getConnectedNode()` causes a null pointer dereference, leading to a crash. This flaw allows attackers to trigger denial-of-service conditions by supplying a specially crafted MTLX file.
DailyCVE Form
Platform: MaterialX
Version: Pre-1.38.8
Vulnerability: Null dereference
Severity: Critical
Date: 2025-05-10
Prediction: Patch by 2025-06-15
What Undercode Say
Reproduce crash ./MaterialXView --malicious.mtlx Debug trace gdb --args MaterialXView nullptr_getshadernodes.mltx
How Exploit
- Crafted MTLX file triggers null pointer.
- Exploitable via file upload/processing.
Protection from this CVE
- Update to patched version.
- Input validation.
Impact
- Application crash (DoS).
- Potential RCE escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
