Luxion KeyShot Heap-Based Buffer Overflow Vulnerability Leading to Remote Code Execution

A heap-based buffer overflow vulnerability has been identified in Luxion KeyShot, specifically within the parsing of DAE files. This issue arises from inadequate validation of user-supplied data lengths before copying them to a heap-based buffer. As a result, remote attackers can execute arbitrary code on affected installations. Exploitation requires user interaction, such as opening a malicious file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the current process.