Luxion KeyShot SKP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

CVE-2024-11577

Summary

A remote code execution vulnerability has been identified in Luxion KeyShot related to the parsing of SKP files. This flaw allows attackers to execute arbitrary code on systems running affected versions of KeyShot, provided that a user interacts with a malicious file or visits a malicious URL. The vulnerability arises due to inadequate validation of user-supplied data, leading to a potential write beyond an allocated buffer limit. Attackers can exploit this weakness to manipulate the process context, thereby compromising the system's integrity. To mitigate this risk, users are advised to update their KeyShot installations and avoid opening untrusted files.

References