GitHub Advisoryadvisory · PyPI

GHSA-grjp-54v3-c442 OpenUSD File Parsing Use-After-Free Remote Code Execution Vulnerability

MEDIUM Published 2025-10-29 Modified 2025-10-29 Official page ↗

Ecosystem: PyPI
Packages: usd-core
Severity: Moderate
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Weaknesses: CWE-416
Reviewed: 2025-10-29

Affected packages

• PyPI usd-core: < 25.11 → fixed in 25.11

Description

Patch This is fixed with commit b953092, with the fix available in OpenUSD 25.11 and onwards. Summary We have been advised by Zero Day Initiative that our usage of the USD framework may constitute a Use-After-Free Remote Code Execution Vulnerability. They have sent us the attached file illustrating the issue. Indeed, we see a use after free exception when running the file through our importer with an address sanitizer. zdi-23709-poc0.zip Thanks in advance.

Weakness · CWE (1)

CWE-416 Use After Free weakness

References

https://github.com/PixarAnimationStudios/OpenUSD/security/advisories/GHSA-grjp-54v3-c442 web
https://github.com/PixarAnimationStudios/OpenUSD/commit/b9530922b6a8ea72cd43661226b693fff8abbe4c web
https://github.com/PixarAnimationStudios/OpenUSD package

GHSA-grjp-54v3-c442 OpenUSD File Parsing Use-After-Free Remote Code Execution Vulnerability

Affected packages

Description

Related

Weakness · CWE (1)

References