OpenUSD crate parsing double free allows remote code execution
Original title: ZDI-26-791: Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability
ZDI rates CVE-2026-92211 at 7.8; library interaction is required and no fix is listed.
The Zero Day Initiative published ZDI-26-791, a double-free flaw in Pixar Animation Studio OpenUSD crate file parsing. Remote attackers can execute arbitrary code on affected installations, but interaction with the library is required and the attack path depends on how the library is used. ZDI assigns a CVSS rating of 7.8 and CVE-2026-92211. The snippet does not name affected versions, a patch, or exploitation.
- The advisory identifier is ZDI-26-791.
- ZDI assigns a CVSS rating of 7.8.
- The bug is in Crate file parsing.
- No affected or fixed version is stated.
Impact: Remote arbitrary code execution after library interaction
| Product | Affected |
|---|---|
| Pixar Animation Studio OpenUSD | — |
- CVEs
- CVE-2026-92211
- Vendors
- Pixar Animation Studio
- Products
- OpenUSD
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92211 | Double Free RCE in Pixar OpenUSD Crate File Parsing | 7.8 | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Pixar Animation Studio OpenUSD. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.