Luxion KeyShot (Update A)

An attacker who tricks a user into opening a malicious file could execute arbitrary code on the system running KeyShot, potentially compromising the workstation and any systems it connects to. This could affect engineering workstations used for design, modeling, or rendering workflows in manufacturing or design environments.

This affects engineering and design workstations that use Luxion KeyShot products for 3D rendering, visualization, and design workflows. Organizations using KeyShot, KeyShot Viewer, or KeyShot Network Rendering in manufacturing design, product visualization, or architectural rendering should prioritize updates. The vulnerability is not network-exploitable on its own but poses risk to any user who handles design files from untrusted sources.

An attacker creates a malicious file (likely a design file or project) and delivers it via email or a compromised website. When a user opens the file in KeyShot, the vulnerabilities allow the attacker's code to execute with the privileges of the user running KeyShot. The attacker could also place scripts into startup folders for persistence across reboots.