Vulnerability Spotlight: Multiple vulnerabilities in Pixar OpenUSD affects some versions of macOS

Summary: Cisco Talos's Aleksandar Nikolic found multiple vulnerabilities in Pixar OpenUSD 20.05 and 20.08, including heap overflows, out-of-bounds memory access, and a use-after-free, several of which can lead to remote code execution when a victim opens an attacker-provided malformed USD file. Because Apple uses USD as the basis of its ARKit, SceneKit, and ModelIO frameworks, macOS registers QuickLook thumbnail and preview handlers for USD files by default, and on iOS the AR application opens a USD file when it is clicked from a web page or message.
What's compelling: A USD file can arrive embedded in a web page or a message and be opened by default handlers on macOS and iOS, so the trigger is a single click rather than an install. Talos confirmed the bugs against macOS Catalina 10.15.3 and 10.15.6, and notes that USD files can reference one another inside a USDZ archive, which it describes as valuable for bypassing exploitation mitigations on modern platforms.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2020-13494 CVE-2020-13495 CVE-2020-13496 CVE-2020-13498 CVE-2020-6155
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026