CVE-2025-7222
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Luxion KeyShot installations by tricking users into opening malicious 3DM files or visiting malicious web pages. The flaw exists in how KeyShot processes 3DM files, enabling buffer overflow attacks that can lead to full system compromise. All users of affected KeyShot versions are at risk.
💻 Affected Systems
- Luxion KeyShot
📦 What is this software?
Keyshot by Luxion
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with attacker gaining the same privileges as the KeyShot user, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Malware installation or data exfiltration through spear-phishing campaigns targeting designers and engineers who regularly exchange 3DM files.
If Mitigated
Limited impact if user runs with minimal privileges and security controls prevent execution of malicious payloads.
🎯 Exploit Status
Exploitation requires user interaction but uses common buffer overflow techniques. ZDI has confirmed the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched version
Vendor Advisory: http://www.keyshot.com/csirt
Restart Required: Yes
Instructions:
1. Visit http://www.keyshot.com/csirt for official advisory
2. Download and install the latest KeyShot update
3. Restart the application and verify update
🔧 Temporary Workarounds
Restrict 3DM file handling
allConfigure system to open 3DM files with alternative applications or in sandboxed environments
User awareness training
allTrain users to only open 3DM files from trusted sources
🧯 If You Can't Patch
- Run KeyShot with minimal user privileges to limit impact of successful exploitation
- Implement application whitelisting to prevent execution of unauthorized code
🔍 How to Verify
Check if Vulnerable:
Check KeyShot version against vendor advisory at http://www.keyshot.com/csirtCheck Version:
Check Help > About in KeyShot application or consult application documentationVerify Fix Applied:
Verify KeyShot version is updated to patched version specified in vendor advisory📡 Detection & Monitoring
Log Indicators:
- KeyShot crash logs with memory access violations
- Unexpected child processes spawned from KeyShot
Network Indicators:
- Unexpected outbound connections from KeyShot process
SIEM Query:
Process creation where parent process contains 'keyshot' AND (command line contains suspicious patterns OR destination IP is malicious)