Listen to this Post
How the CVE Works
In MaterialXCore’s Material.cpp, when parsing shader nodes from an MTLX file, the code retrieves an output node (implGraphOutput) without checking if it is null. The function `traverseGraph()` is then called on this potentially null pointer, leading to a dereference crash. This occurs in the graph iteration loop where `implGraphOutput` is assumed valid, but a maliciously crafted MTLX file can omit required node definitions, triggering the vulnerability.
DailyCVE Form
Platform: MaterialX
Version: <1.38.6
Vulnerability: Null dereference
Severity: Medium
Date: 2025-05-30
Prediction: Patch by 2025-07-15
What Undercode Say
gdb --args MaterialXView --material exploit.mtlx valgrind ./MaterialXView
How Exploit
Craft MTLX with missing node.
Load via MaterialXView.
Triggers null dereference crash.
Protection from this CVE
Update to v1.38.6+.
Validate MTLX inputs.
Add null checks.
Impact
Application crash.
DoS via malicious file.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
