GHSA-grjp-54v3-c442
GHSA-grjp-54v3-c442 · OpenUSD File Parsing Use-After-Free Remote Code Execution Vulnerability
This page contains facts from public vulnerability sources. Check the original advisory before updating.
# Patch This is fixed with [commit b953092](https://github.com/PixarAnimationStudios/OpenUSD/commit/b9530922b6a8ea72cd43661226b693fff8abbe4c), with the fix available in OpenUSD 25.11 and onwards. # Summary We have been advised by Zero Day Initiative that our usage of the USD framework may constitute a Use-After-Free Remote Code Execution Vulnerability. They have sent us the attached file illustrating the issue. Indeed, we see a use after free exception when running the file through our importer with an address sanitizer. [zdi-23709-poc0.zip](https://github.com/user-attachments/files/17474297/zdi-23709-poc0.zip) Thanks in advance.
CVSS 6.9 · Medium · Fix available
- Published
- Updated
Stack: python
Affected products and versions
usd-core PyPI
- Versions
- 20.11
- 21.11
- 21.2
- 21.5
- 21.8
- 22.11
- 22.3
- 22.5
- 22.5.post1
- 22.8
- 23.11
- 23.2
- 23.5
- 23.8
- 24.11
- 24.3
- 24.5
- 24.8
- 25.2
- 25.2.post1
- 25.5
- 25.5.1
- 25.8
- Affected ranges
- ECOSYSTEM: < 25.11
Update to 25.11