Luxion KeyShot 3DM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Luxion KeyShot, specifically within the 3DM file parsing process. This issue arises from inadequate validation of user-supplied data, leading to an out-of-bounds write that allows for arbitrary code execution in the context of the current process. Exploitation of this vulnerability requires user interaction, as the target must open a malicious 3DM file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system.

Remediation

Luxion has released an update to address this vulnerability. Users can find more information on the KeyShot CSIRT page.