Pixar's vulnerability footprint concentrates in a narrow but prominent set of specialized graphics, rendering, and production-pipeline software including OpenUSD, RenderMan, Tractor, and Ruby-JSS, which serve as critical components in animation and visual-effects workflows. The vendor's disclosures cluster around memory-safety and input-validation weaknesses, including out-of-bounds writes and reads, heap-based buffer overflows, and improper bounds checking, which are characteristic of computationally intensive rendering and geometry-processing codebases. While the product count is small, these tools occupy a high-value position in professional creative pipelines, making their security relevant to studios and production environments that depend on them. Defenders should track Pixar releases as part of broader supply-chain risk in visual-effects and animation infrastructure; live severity, exploitation status, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Pixar over time
Signals from CVEs in this vendor scope (22 CVEs).
22 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-33575CRITICAL The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.load during XML document proce | May 25, 2021 | 9.8 | 32 | NO | NO |
CVE-2020-13531HIGH A use-after-free vulnerability exists in a way Pixar OpenUSD 20.08 processes reference paths textual USD files. A specially crafted file can trigger the reuse of a freed memory whi | Dec 3, 2020 | 8.8 | 27 | NO | NO |
CVE-2018-4054HIGH A local privilege escalation vulnerability exists in the install helper tool of the Mac OS X version of Pixar Renderman, version 22.2.0. A user with local access can use this vulne | Mar 8, 2019 | 7.8 | 26 | NO | NO |
CVE-2020-6155HIGH A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 while parsing compressed value rep arrays in binary USD files. A specially crafted malformed file can trigger a heap | Nov 13, 2020 | 7.8 | 25 | NO | NO |
CVE-2019-5015HIGH A local privilege escalation vulnerability exists in the Mac OS X version of Pixar Renderman 22.3.0's Install Helper helper tool. A user with local access can use this vulnerabilit | Mar 8, 2019 | 7.8 | 25 | NO | NO |
CVE-2018-3841HIGH A denial-of-service vulnerability exists in the Pixar Renderman IT Display Service 21.6 (0x69). The vulnerability is present in the parsing of a network packet without proper valid | Jun 26, 2018 | 7.5 | 24 | NO | NO |
CVE-2018-3840HIGH A denial-of-service vulnerability exists in the Pixar Renderman IT Display Service 21.6 (0x67). The vulnerability is present in the parsing of a network packet without proper valid | Jun 26, 2018 | 7.5 | 24 | NO | NO |
CVE-2020-6150HIGH A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software USDC file format SPECS section decompression heap overflow. | Nov 13, 2020 | 7.8 | 23 | NO | NO |
CVE-2020-6149HIGH A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. To trigger this vulnerability, the victim needs to ope | Nov 13, 2020 | 7.8 | 23 | NO | NO |
CVE-2020-6148HIGH A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. An instance exists in USDC file format FIELDSETS secti | Nov 13, 2020 | 7.8 | 23 | NO | NO |
Signals from CVEs in this vendor scope (22 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Pixar.
Media articles that mention a CVE ID that affects a product developed by Pixar — matched by CVE ID, not by vendor name.