A malicious actor may convince a user to open a malicious USD file that may trigger an uninitialized pointer which could result in code execution.
CWE-824, CWE-824