What’s Vulnerable › Vulnerabilities

CVE-2025-4605: USD File Parsing Memory Allocation Vulnerability

• Severity: medium (CVSS 6.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-11 · updated 2026-06-17
• Weakness: CWE-789

Description

A maliciously crafted .usdc file, when loaded through Autodesk Maya, can force an uncontrolled memory allocation vulnerability. A malicious actor may leverage this vulnerability to cause a denial-of-service (DoS), or cause data corruption.

Affected products

• Autodesk Maya: from 2025 before 2025.3.1 — fixed in 2025.3.1
• Autodesk Universal Scene Description: 0.10, 0.31.0

How to fix

Upgrade to a fixed version: Autodesk Maya 2025.3.1. Check the vendor advisory for mitigations.

References

• https://github.com/Autodesk/3dsmax-usd
• https://github.com/Autodesk/maya-usd
• https://www.autodesk.com/products/autodesk-access/overview
• https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0011

Get alerted when CVE-2025-4605 or the next vulnerability affects your stack