MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion Limit
Date: 2025-07
Affected: pip/MaterialX
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-53009
CWE: CWE-121

### Summary When parsing an MTLX file with multiple nested `nodegraph` implementations, the MaterialX XML parsing logic can potentially crash due to stack exhaustion. ### Details By specification, multiple kinds of elements in MTLX support nesting other elements, such as in the case of `nodegraph` elements. Parsing these subtrees is implemented via recursion, and since there is no max depth imposed on the XML document, this can lead to a stack overflow when the library parses an MTLX file with an excessively high number of nested elements. ### PoC Please download the `recursion_overflow.mtlx` file from the following link: https://github.com/ShielderSec/poc/tree/main/CVE-2025-53009 `build/bin/MaterialXView --material recursion_overflow.mtlx` ### Impact An attacker could intentionally crash a target program that uses MaterialX by sending a malicious MTLX file.


Mitigations:

Architectural layers (MAESTRO):