Listen to this Post
How the CVE Works
MaterialX files support nested imports via XInclude tags, processed recursively without depth limits. An attacker can craft a chain of MaterialX files referencing each other in a deep loop. When parsed, this exhausts stack memory, crashing the application. On Windows, UNC paths enable remote exploitation by forcing recursive file fetches over SMB. The lack of import depth validation allows stack overflow (STATUS_STACK_OVERFLOW).
DailyCVE Form
Platform: MaterialX
Version: <= 1.39
Vulnerability: Stack exhaustion
Severity: Critical
Date: 2023-08-10
Prediction: Patch by 2023-10-15
What Undercode Say
Analytics:
python3 script.py --iterations 1048576 template.mtlx chain $IP chain pipx run --spec impacket smbserver.py -smb2support chain chain/
How Exploit
1. Craft recursive `.mtlx` files.
2. Host via SMB (Windows UNC).
3. Trigger parsing in MaterialXView.
Protection from this CVE
- Limit import depth.
- Disable remote XIncludes.
- Update to patched version.
Impact
- Remote DoS (Windows).
- Local DoS (other OS).
- Application crash.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
