GHSA-grjp-54v3-c442
GHSA-grjp-54v3-c442 · OpenUSD File Parsing Use-After-Free Remote Code Execution Vulnerability
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
# Patch This is fixed with [commit b953092](https://github.com/PixarAnimationStudios/OpenUSD/commit/b9530922b6a8ea72cd43661226b693fff8abbe4c), with the fix available in OpenUSD 25.11 and onwards. # Summary We have been advised by Zero Day Initiative that our usage of the USD framework may constitute a Use-After-Free Remote Code Execution Vulnerability. They have sent us the attached file illustrating the issue. Indeed, we see a use after free exception when running the file through our importer with an address sanitizer. [zdi-23709-poc0.zip](https://github.com/user-attachments/files/17474297/zdi-23709-poc0.zip) Thanks in advance.
CVSS 6.9 · Moyenne · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: python
Produits et versions concernés
usd-core PyPI
- Versions du logiciel
- 20.11
- 21.11
- 21.2
- 21.5
- 21.8
- 22.11
- 22.3
- 22.5
- 22.5.post1
- 22.8
- 23.11
- 23.2
- 23.5
- 23.8
- 24.11
- 24.3
- 24.5
- 24.8
- 25.2
- 25.2.post1
- 25.5
- 25.5.1
- 25.8
- Plages de versions concernées
- ECOSYSTEM: < 25.11
Mettez à jour vers 25.11