Luxion KeyShot PVS File Parsing Access of Uninitialized Pointer Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Luxion KeyShot, specifically in the parsing of PVS files. This issue arises from the improper initialization of a pointer before it is accessed, allowing remote attackers to execute arbitrary code on affected installations. Exploitation of this vulnerability requires user interaction, as the target must open a malicious PVS file. The vulnerability affects all KeyShot versions prior to 2025.1.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the current process.

Remediation

Users are advised to upgrade to KeyShot version 2025.1 or later.