CVE-2021-22645

CVE-2021-22645 affects Luxion KeyShot family prior to 10.1, specifically KeyShot, KeyShot Viewer, KeyShot Network Rendering, and KeyVR. The vulnerability arises from .bip documents displaying a “load” command that can reference a remote DLL, allowing the DLL entry point to execute without suffici...

CVE-2021-22647

CVE-2021-22647 affects Luxion KeyShot family: KeyShot, KeyShot Viewer, KeyShot Network Rendering, and KeyVR versions prior to 10.1. The vulnerability is described as multiple out-of-bounds write issues encountered while processing project files, which may allow an attacker to execute arbitrary co...

CVE-2021-22643

CVE-2021-22643 affects Luxion KeyShot family: KeyShot, KeyShot Viewer, KeyShot Network Rendering, and KeyVR prior to version 10.1. The vulnerability is an out-of-bounds read while processing project files, which may allow arbitrary code execution. Red Hat’s entry corroborates the same affected pr...

CVE-2021-22649

Luxion KeyShot family (KeyShot, KeyShot Viewer, KeyShot Network Rendering, KeyVR) prior to 10.1 are affected by multiple NULL pointer dereference issues while processing project files. Root cause: NULL pointer dereferences in project-file handling, potentially allowing arbitrary code execution. A...

CVE-2025-2531

Luxion KeyShot is affected by a heap-based buffer overflow in DAE file parsing that leads to Remote Code Execution. The flaw arises from insufficient validation of the length of user-supplied data before copying it into a heap buffer during DAE parsing. Exploitation requires user interaction (tar...

CVE-2025-0412

Luxion KeyShot Viewer vulnerable via KSP file parsing due to improper validation of user-supplied data, causing memory corruption and remote code execution. Impact is actionable when a user opens a malicious KSP file or visits a crafted page; the attacker can execute code in the process context. ...

CVE-2021-27492

The CVE-2021-27492 entry concerns Datakit CrossCADWare libraries (CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr) embedded in Luxion KeyShot v10.1 and earlier. The connected Red Hat, ZDI, and ICS/CERT records confirm a concrete XXE-style vulnerability: when opening a special...

CVE-2021-27496

CVE-2021-27496 affects Datakit CrossCADWare libraries embedded in Luxion KeyShot (v10.1 and earlier). Modules CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, and Jt3dReadPsr fail to validate data when parsing PRT files, causing untrusted pointer dereference and potential code execution i...

CVE-2021-27488

CVE-2021-27488 affects Datakit CrossCAD/Ware libraries (CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr) embedded in Luxion KeyShot up to v10.1. The vulnerability stems from improper validation when parsing CATPart files, enabling an out-of-bounds write and potential code exe...

CVE-2024-11576

Luxion KeyShot is affected by a heap-based buffer overflow in 3DS file parsing, enabling remote code execution. The flaw arises from insufficient validation of the length of user-supplied data before copying to a heap buffer. Exploitation requires user interaction (visiting a malicious page or op...

CVE-2021-27494

CVE-2021-27494 affects Datakit CrossCADWare libraries (CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr) bundled in Luxion KeyShot (Versions 10.1 and earlier). The vulnerability is an out-of-bounds stack/write caused by inadequate validation when parsing STP files, which can a...

CVE-2021-27490

Datakit CrossCADWare libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr embedded in Luxion KeyShot (versions ≤ 10.1) are affected by CVE-2021-27490 due to an out-of-bounds read when parsing CATPart data, potentially allowing code execution in the affected process. Red ...

CVE-2024-30375

Summary (CVE-2024-30375): Luxion KeyShot Viewer is affected by a use-after-free in KSP file parsing that can lead to remote code execution. The vulnerability stems from not validating the existence of an object before performing operations, allowing an attacker to execute code in the context of t...

CVE-2024-5508

CVE-2024-5508 affects Luxion KeyShot Viewer. The flaw is in the parsing of KSP files, caused by insufficient validation of user-supplied data, which can trigger an out-of-bounds write and allow remote code execution in the process context. Exploitation requires user interaction (visiting a malici...

CVE-2025-1047

Luxion KeyShot is affected by CVE-2025-1047 through a vulnerability in PVS file parsing caused by an uninitialized pointer. The issue enables Remote Code Execution in the context of the current process and requires user interaction (target visits a malicious page or opens a malicious file). The v...

CVE-2025-2530

Luxion KeyShot is affected by a DAE file parsing vulnerability tied to an uninitialized pointer, enabling remote code execution. The flaw resides in parsing .dae files and requires user interaction (visiting a malicious page or opening a malicious file). Affected software versions include Luxion ...

CVE-2021-22651

CVE-2021-22651 concerns a path traversal vulnerability in Luxion KeyShot family products (KeyShot, KeyShot Viewer, KeyShot Network Rendering, KeyVR) prior to version 10.1. During extraction of temporary files, an attacker could leverage directory traversal to write arbitrary scripts into automati...

CVE-2024-5506

CVE-2024-5506 refers to a vulnerability in Luxion KeyShot Viewer where the KSP file parser can lead to an out-of-bounds write, enabling remote code execution. The flaw arises from insufficient validation of user-supplied data during KSP parsing, allowing a write past the end of an allocated buffe...

CVE-2024-5509

CVE-2024-5509 concerns Luxion KeyShot: a flaw in BIP file parsing enables an attacker to load a library from an unsecured location, leading to remote code execution . The vulnerability arises from an uncontrolled search path element, allowing code execution in the context of the current process. ...

CVE-2024-5507

CVE-2024-5507 (Luxion KeyShot Viewer) : A stack-based buffer overflow in the parsing of KSP files can enable remote code execution in affected KeyShot Viewer installations. The flaw arises from insufficient validation of the length of user-supplied data prior to copying it to a stack-based buffer...

CVE-2025-2532

Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution Vulnerability. The flaw occurs in parsing of usdc files, due to not validating the existence of an object before operating on it, allowing code execution in the target process. Exploitation requires user interaction (visiting a...

CVE-2025-1046

CVE-2025-1046 – Luxion KeyShot : The vulnerability arises in SKP file parsing where the code operates on objects without validating their existence, causing a use-after-free that can lead to remote code execution. This is exploitable when a user opens a malicious SKP file or visits a crafted page...

CVE-2024-11581

Luxion KeyShot is affected by a CVE-2024-11581 vulnerability in the JT file parsing code. The issue is an out-of-bounds read caused by insufficient validation of data during parsing of .jt files, which can allow an attacker to execute code in the context of the current process. Exploitation requi...

CVE-2024-30374

The CVE-2024-30374 entry concerns Luxion KeyShot Viewer. Affected component: KSP file parsing in the viewer, with an out-of-bounds write due to inadequate validation of user-supplied data. Impact: remote code execution by an attacker who entices a target to visit a malicious page or open a malici...

CVE-2025-1045

Luxion KeyShot Viewer is affected by a KSP file parsing heap-based buffer overflow that enables remote code execution. The vulnerability stems from inadequate validation of the length of user-supplied data before copying it to a heap buffer, allowing an attacker to run code in the current process...

CVE-2024-11579

Luxion KeyShot is affected by an OBJ file parsing vulnerability that can cause an out-of-bounds write, enabling remote code execution. The flaw arises from insufficient validation of the OBJ data, allowing an attacker to write past the end of an allocated buffer during parsing. Exploitation requi...

CVE-2024-11578

The CVE-2024-11578 entry affects Luxion KeyShot, specifically a vulnerability in 3DS file parsing. The issue is a stack-based buffer overflow caused by insufficient validation of the length of user-supplied data before copying it to a stack buffer, enabling arbitrary code execution. Exploitation ...

CVE-2024-11577

CVE-2024-11577 is a vulnerability in Luxion KeyShot related to parsing SKP files. The flaw is an out-of-bounds write caused by insufficient validation of user-supplied data, which can write past the end of an allocated buffer and allow code execution in the context of the current process. Exploit...

CVE-2024-11580

CVE-2024-11580 : Luxion KeyShot is affected by a heap-based buffer overflow in the parsing of ABC files. The flaw arises from insufficient validation of the length of user-supplied data before copying to a heap buffer, enabling remote code execution. Exploitation requires user interaction (the ta...

CVE-2025-7222

Luxion KeyShot is affected by CVE-2025-7222 due to an out-of-bounds write during 3DM file parsing, caused by insufficient validation of user-supplied data. This may allow remote code execution in the context of the current process when a user opens a malicious file or visits a malicious page. The...