Autodesk FBX SDK

An attacker could achieve code execution or crash engineering workstations and CAD systems by sending a malicious FBX 3D model file. This could disrupt design workflows, compromise credentials on workstations used for control system design, or prevent access to critical design and configuration files.

Engineering and CAD workstations using Luxion KeyShot or any software built on Autodesk FBX SDK for 3D modeling. This affects design firms, manufacturers using CAD for control system design, and any organization where engineers work with 3D models or visualizations. The risk is elevated for utilities and manufacturers where the same workstations may be used to design or configure industrial control systems.

An attacker creates a malicious FBX 3D model file with crafted binary data that triggers a memory vulnerability (out-of-bounds read/write or use-after-free). When an engineer opens the file in KeyShot or any application using vulnerable FBX SDK, the malicious code executes with the privileges of that user. If that workstation is used for control system design or engineering, the attacker gains access to the engineering environment.