-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a classic null pointer dereference. The analysis of the provided security advisory and the associated commit e13344ba13326869d7820b444705f24d56fab73d clearly indicates that the getShaderNodes function in source/MaterialXCore/Material.cpp is the culprit. The patch itself demonstrates the vulnerability by adding a null check for the OutputPtr returned by nodeGraph->getOutput(). Before the patch, a specially crafted MaterialX file could cause getOutput() to return a null pointer. This null pointer would then be added to the outputs vector. Later in the function, the code iterates through the outputs vector and calls a method on each element, resulting in a crash when it tries to dereference the null pointer. Therefore, any runtime profile of an exploit triggering this vulnerability would show the getShaderNodes function in the stack trace at the time of the crash.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| MaterialX | pip | = 1.39.2 | 1.39.3 |
PythonPython