Remote Code Execution Vulnerability in Pixar Animation Studio OpenUSD
CVE-2026-92211

7.8HIGH

Key Information:

Vendor

Pixar Animation Studio

Status
Openusd
Vendor
CVE Published:
3 November 2026

What is CVE-2026-92211?

A vulnerability in Pixar Animation Studio's OpenUSD software allows remote attackers to execute arbitrary code due to improper handling of USDC and USDZ file parsing. The flaw results from failing to validate the existence of an object before performing free operations, which can be exploited if the parsing library is interacted with. Depending on the implementation, the attack vectors may vary, posing a significant risk to the integrity of the system.

Affected Version(s)

OpenUSD v26.03

References

https://www.zerodayinitiative.com/advisories/ZDI-26-791/
x_research-advisory
https://github.com/PixarAnimationStudios/OpenUSD/commit/7...
vendor-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.