Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Patch This is fixed with commit b953092, with the fix available in OpenUSD 25.11 and onwards. Summary We have been advised by Zero Day Initiative that our usage of the USD framework may constitute a Use-After-Free Remote Code Execution Vulnerability. They have sent us the attached file illustrating the issue. Indeed, we see a use after free exception when running the file through our importer with an address sanitizer. zdi-23709-poc0.zip Thanks in advance.
Recommended action: Upgrade to 25.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Use-After-Free (UAF) vulnerability has been discovered in the SdfPathNode module of the Pixar OpenUSD library. This issue occurs during the deletion of the SdfPrimPathNode object in multi-threaded environments, where freed memory is accessed. This results in segmentation faults or bus errors, allowing attackers to potentially exploit the vulnerability for remote code execution (RCE). By using a specially crafted .usd file, an attacker could gain control of the affected system. The vulnerability has been confirmed in multiple OpenUSD tools, including sdfdump, usdtree, usdcat, and sdffilter. Patches This is fixed with commit 0d74f31, with the fix available in OpenUSD 25.08 and onwards. Details The issue is a Use-After-Free vulnerability in the SdfPathNode destruction process, specifically in SdfPrimPathNode::~SdfPrimPathNode(). When multiple threads attempt to destroy or modify the same SdfPathNode object, a race condition can occur, causing the object to be accessed after it…
Recommended action: Upgrade to 25.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.