Luxion KeyShot 3DS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2024-11576

Summary

A vulnerability exists in Luxion KeyShot relating to the parsing of 3DS files, resulting in a heap-based buffer overflow. This flaw arises from inadequate validation of user-supplied data lengths before it is copied to a buffer in memory. An attacker can exploit this vulnerability to execute arbitrary code in the context of the affected process. Successful exploitation requires the user to interact with a malicious web page or open a specially crafted 3DS file, highlighting the need for heightened vigilance in file handling procedures.

References