Use-After-Free Vulnerability in Luxion KeyShot Product
CVE-2025-1046

7.8HIGH

Key Information:

Vendor
Luxion
Status
Keyshot
Vendor
CVE Published:
23 April 2025

Summary

A vulnerability in the parsing of SKP files within Luxion KeyShot allows remote attackers to execute arbitrary code. The flaw arises from the failure to verify the presence of an object before operating on it. An attacker must entice a user to open a malicious file or visit a harmful webpage to exploit this weakness, executing code in the context of the current process and potentially compromising system integrity.

Affected Version(s)

KeyShot 2024 13.0.0 Build 92 4.10.171

References

https://www.zerodayinitiative.com/advisories/ZDI-25-231/
x_research-advisory
https://download.keyshot.com/cert/ksa-113962/ksa-113962.p...
vendor-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-1046 : Use-After-Free Vulnerability in Luxion KeyShot Product | SecurityVulnerability.io