Back Linuxsecurity

Fedora 43: usd Critical Remote Code Execution Advisory 2025

Linuxsecurity •LinuxSecurity Advisories • January 2, 2026

Universal Scene Description (USD) is a time-sampled scene description for interchange between graphics applications. Update Information : Backport fix for CVE-2025-14439/GHSA-grjp-54v3-c442

Universal Scene Description (USD) is a time-sampled scene

description for interchange between graphics applications.

Backport fix for CVE-2025-14439/GHSA-grjp-54v3-c442

* Wed Dec 24 2025 Benjamin A. Beasley - 25.08-13 - Backport fix for CVE-2025-14439/GHSA-grjp-54v3-c442 (fix RHBZ#2422276)

[ 1 ] Bug #2422276 - CVE-2025-14439 usd: OpenUSD File Parsing Use-After-Free Remote Code Execution Vulnerability [fedora-43] [ 2 ] Bug #2424922 - CVE-2025-12839 usd: OpenEXR: Remote Code Execution via Heap-based Buffer Overflow in EXR File Parsing [fedora-43] [ 3 ] Bug #2424924 - CVE-2025-12840 usd: OpenEXR: Remote Code Execution via EXR file parsing heap-based buffer overflow [fedora-43] [ 4 ] Bug #2424926 - CVE-2025-12495 usd: OpenEXR: Remote Code Execution via malicious EXR file parsing [fedora-43]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-f882263432' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora Releases Backport Fix for CVE-2025-14439 RCE Vulnerability Fedora has issued backport fixes for the critical remote code execution vulnerability CVE-2025-14439 affecting Universal Scene Description (USD). The vulnerability impacts users of Fedora 42 and Fedora 43, with updates provided on December 24 and December 25, 2025, respectively. 2 sources 58

Extracted Entities

Fedora 43: usd Critical Remote Code Execution Advisory 2025

The full story

Extracted Entities

Companies (1)

CVEs (4)

Platforms (2)