Security Digest · Critical advisory (no CVE assigned)
GHSA-58p5-r2f6-g2cj: Pixar OpenUSD Sdf_PathNode Module Use-After-Free Vulnerability Leading to Potential Remote Code Execution
Summary A Use-After-Free (UAF) vulnerability has been discovered in the SdfPathNode module of the Pixar OpenUSD library.
CVSS 9.4 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
pip-audit (or: pip show <package>). - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| PyPI | usd-core | < 25.8 | 25.8 |
Details
Summary A Use-After-Free (UAF) vulnerability has been discovered in the SdfPathNode module of the Pixar OpenUSD library. This issue occurs during the deletion of the SdfPrimPathNode object in multi-threaded environments, where freed memory is accessed. This results in segmentation faults or bus errors, allowing attackers to potentially exploit the vulnerability for remote code execution (RCE). By using a specially crafted .usd file, an attacker could gain control of the affected system. The vulnerability has been confirmed in multiple OpenUSD tools, including sdfdump, usdtree, usdcat, and sdffilter.
Patches
This is fixed with commit 0d74f31, with the fix available in OpenUSD 25.08 and onwards.
Details The issue is a Use-After-Free vulnerability in the SdfPathNode destruction process, specifically in SdfPrimPathNode::~SdfPrimPathNode(). When multiple threads attempt to destroy or modify the same SdfPathNode object, a race condition can occur, causing the object to be accessed after it has been freed. This leads to segmentation faults or bus errors, as observed in the crash logs.
PoC 1. Upload all proof-of-concept file poc.usd.zip 3. Put any additional instructions or explanation for executing the proof-of-concept here A crafted .usd file is attached, which triggers the vulnerability when loaded into any of the affected tools. This issue has been successfully reproduced in both Linux and macOS environments.
- Build the OpenUSD tools using the provided build instructions:
- Run one of the vulnerable tools (e.g., sdffilter) with the provided crafted .usd file.
Impact OpenUSD, managed by the Alliance for OpenUSD (AOUSD), is widely adopted by major organizations such as Apple, NVIDIA, Autodesk, and Pixar. It serves as a key standard in industries like film, animation, gaming, AR/VR, and simulation. Exploitation of this vulnerability could lead to severe consequences, including system compromise, unauthorized data access, and disruption of services relying on OpenUSD. Given its critical role in 3D content creation and its widespread use, this vulnerability poses a significant threat to system security and data integrity. Immediate action is required…
CVSS: 9.4 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Sources and references
- GitHub Advisory GHSA-58p5-r2f6-g2cj github.com
- github.com github.com
- github.com github.com