Code execution via heap buffer overflow

Buffer overflow in Model I/O in Apple iOS and iPadOS before 14.4 and macOS before 11.2 allows attackers to execute code via a crafted USD file. The framework parses crafted USD data into a heap buffer without adequate bounds checking, allowing the data to overflow that buffer. Exploitation requires a process to parse the file and can crash that process or execute code in its context; no elevated privilege is required.