Remote Code Execution Vulnerability in Luxion KeyShot Viewer Due to KSP File Parsing
CVE-2024-5506

7.8HIGH

Key Information:

Vendor
Luxion
Status
Keyshot Viewer
Vendor
CVE Published:
6 June 2024

Summary

An Out-Of-Bounds Write vulnerability exists in the Luxion KeyShot Viewer, specifically within the KSP file parsing functionality. This flaw arises from inadequate validation of input data, allowing attackers to overwrite memory beyond the allocated buffer. By tricking users into opening a malicious KSP file or visiting an infected page, an attacker can execute arbitrary code in the context of the application, potentially leading to system compromise. This poses a significant risk to user security and underscores the importance of updating to the latest version of the software.

Affected Version(s)

KeyShot Viewer 2023.3_12.2.1.2

References

https://www.zerodayinitiative.com/advisories/ZDI-24-538/
x_research-advisory
https://www.keyshot.com/csirt/
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.