ZDI 2026-10-26

ZDI-26-791: Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability

CVE-2026-92211

Machine-generated analysis · WAYSCloud LLM

The advisory notes a double-free in OpenUSD’s crate file parser that can be triggered remotely.

Context

Pixar Animation Studio OpenUSD is the affected component. The vulnerability is a double-free in the crate file parsing code that enables remote code execution. Exploitation requires interaction with the library, and the exact attack vector may depend on how the library is integrated.

Operator considerations

Check: Verify which systems have Pixar Animation Studio OpenUSD installed and record their versions.
Isolate: Consider isolating affected OpenUSD instances from untrusted networks until a fix is available.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Pixar Animation Studio OpenUSD. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-92211.

Read the full advisory on ZDI →