Luxion KeyShot Use-After-Free Remote Code Execution Vulnerability

A use-after-free vulnerability has been identified in Luxion KeyShot, specifically in the parsing of SKP files. This issue allows remote attackers to execute arbitrary code on affected installations. The vulnerability arises from the Sketchup importer not properly validating the existence of an object before performing operations on it. Exploitation requires user interaction, as the target must open a malicious SKP file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the current process.

Remediation

Users are advised to upgrade to KeyShot version 2025.1 or later.