GHSA-grjp-54v3-c442 OpenUSD File Parsing Use-After-Free Remote Code Execution Vulnerability
A use-after-free vulnerability in OpenUSD allows remote code execution when parsing malicious files, requiring user interaction to open the file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-grjp-54v3-c442?
GHSA-grjp-54v3-c442 is an use after free vulnerability in usd-core, published on 29 Oct 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Patch
This is fixed with commit b953092, with the fix available in OpenUSD 25.11 and onwards.
Summary
We have been advised by Zero Day Initiative that our usage of the USD framework may constitute a Use-After-Free Remote Code Execution Vulnerability. They have sent us the attached file illustrating the issue. Indeed, we see a use after free exception when running the file through our importer with an address sanitizer.
Thanks in advance.
Which versions are affected by GHSA-grjp-54v3-c442?
2 open source packages ship an affected version, including usd-core.
| Package | Affected | Fixed in |
|---|---|---|
usd-core PyPI | All versions | 25.11 |
usd-core PyPI | All versions | 25.11 |
How do I fix GHSA-grjp-54v3-c442?
Upgrade usd-core to 25.11 or later.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is GHSA-grjp-54v3-c442 being exploited?
There is no known exploitation of GHSA-grjp-54v3-c442 in the wild and no public exploit code.