Luxion KeyShot ABC File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2024-11580

Summary

The vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot by exploiting a flaw in the parsing of abc files. This issue arises due to inadequate validation of the length of user-supplied data before it is copied to a heap-based buffer. Consequently, an attacker can execute code in the context of the current process when the targeted user interacts with a malicious page or opens a compromised file. Proper security measures and updates are essential to mitigate this risk.

References