Luxion KeyShot 3DS File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2024-11578

Summary

A vulnerability exists in the Luxion KeyShot product related to the parsing of 3DS files, which can be exploited by remote attackers to execute arbitrary code on affected installations. The vulnerability stems from insufficient validation of the length of user-supplied data prior to being copied into a stack-based buffer. Successful exploitation requires user interaction, necessitating that the target opens a malicious file or visits a compromised web page. Attackers leveraging this flaw can run code in the context of the current process, potentially leading to unauthorized actions and data breaches.

References