GHSA-grjp-54v3-c442
GHSA-grjp-54v3-c442 · OpenUSD File Parsing Use-After-Free Remote Code Execution Vulnerability
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
# Patch This is fixed with [commit b953092](https://github.com/PixarAnimationStudios/OpenUSD/commit/b9530922b6a8ea72cd43661226b693fff8abbe4c), with the fix available in OpenUSD 25.11 and onwards. # Summary We have been advised by Zero Day Initiative that our usage of the USD framework may constitute a Use-After-Free Remote Code Execution Vulnerability. They have sent us the attached file illustrating the issue. Indeed, we see a use after free exception when running the file through our importer with an address sanitizer. [zdi-23709-poc0.zip](https://github.com/user-attachments/files/17474297/zdi-23709-poc0.zip) Thanks in advance.
CVSS 6.9 · Media · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: python
Productos y versiones afectados
usd-core PyPI
- Versiones
- 20.11
- 21.11
- 21.2
- 21.5
- 21.8
- 22.11
- 22.3
- 22.5
- 22.5.post1
- 22.8
- 23.11
- 23.2
- 23.5
- 23.8
- 24.11
- 24.3
- 24.5
- 24.8
- 25.2
- 25.2.post1
- 25.5
- 25.5.1
- 25.8
- Intervalos de versiones afectados
- ECOSYSTEM: < 25.11
Actualiza a 25.11