CVE-2024-11581 Overview
CVE-2024-11581 is an out-of-bounds read vulnerability [CWE-125] in Luxion KeyShot that enables arbitrary code execution when a user opens a crafted JT file. The flaw resides in the JT file parser, which fails to validate user-supplied data before performing a read operation. An attacker can trigger a read before the start of an allocated buffer and execute code in the context of the KeyShot process. Exploitation requires user interaction, such as opening a malicious file or visiting a page that delivers one. The issue was reported through the Trend Micro Zero Day Initiative as ZDI-CAN-23826 and disclosed in advisory ZDI-24-1612.
Critical Impact
Successful exploitation grants arbitrary code execution in the context of the user running KeyShot, enabling full compromise of the workstation and any accessible design assets.
Affected Products
- Luxion KeyShot (versions prior to the vendor-issued fix referenced in the Luxion security advisory KSA-655925)
- KeyShot installations processing untrusted .jt (Jupiter Tessellation) 3D model files
- Engineering and design workstations that import third-party CAD data into KeyShot
Discovery Timeline
- 2024-11-22 - CVE-2024-11581 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-11581
Vulnerability Analysis
The vulnerability is an Out-of-Bounds Read [CWE-125] within KeyShot's JT file parser. JT is a widely used 3D model format for CAD interoperability, and KeyShot imports it to render photorealistic visualizations. The parser reads structured data from the file without confirming that offsets and indices remain within the bounds of the underlying allocated buffer.
When a malformed JT file supplies attacker-controlled length or offset fields, the parser dereferences memory before the start of the allocation. This out-of-bounds read exposes adjacent process memory and can be combined with heap grooming to influence control-flow data. An attacker can chain this primitive to redirect execution and run arbitrary code in the user's session.
Exploitation is local and requires user interaction, but the delivery surface is broad. Malicious JT files can be delivered via email attachments, shared engineering repositories, or drive-by download pages.
Root Cause
The root cause is the lack of proper validation of user-supplied data in the JT parsing routines. Length and offset fields embedded in the file are trusted without bounds checks, allowing a crafted structure to reference memory outside the allocated buffer boundary.
Attack Vector
The attack requires the victim to open a malicious JT file with a vulnerable version of KeyShot. Delivery mechanisms include phishing attachments, shared network drives used by design teams, and web pages that prompt users to download and open the file. No network-facing service is required; the attack surface is the desktop application. See the Zero Day Initiative Advisory ZDI-24-1612 for additional context.
No public proof-of-concept exploit is available at the time of writing. The vulnerability manifests during file parsing before any rendering occurs, meaning simply loading the file into KeyShot is sufficient to trigger the flaw.
Detection Methods for CVE-2024-11581
Indicators of Compromise
- Unexpected KeyShot process crashes or hangs immediately after opening a .jt file from an untrusted source
- KeyShot spawning child processes such as cmd.exe, powershell.exe, or scripting hosts that do not belong in a rendering workflow
- Outbound network connections initiated by the KeyShot process to unfamiliar external hosts shortly after file open
- New persistence artifacts (scheduled tasks, Run keys, or startup items) created under the user context that launched KeyShot
Detection Strategies
- Alert on KeyShot loading .jt files that originate from email attachments, browser download directories, or removable media
- Monitor for anomalous memory access violations or Windows Error Reporting entries associated with the KeyShot binary
- Baseline expected child processes of KeyShot and flag deviations, particularly interpreter or shell processes
- Correlate JT file opens with subsequent file writes to sensitive directories or credential stores
Monitoring Recommendations
- Enable EDR telemetry for process creation, image load, and file access events on workstations running KeyShot
- Track SHA-256 hashes of JT files transiting mail gateways and file-sharing platforms to support retrospective hunts
- Log user acknowledgment of Mark-of-the-Web prompts when opening .jt files downloaded from the internet
How to Mitigate CVE-2024-11581
Immediate Actions Required
- Update KeyShot to the fixed release identified in the Luxion KeyShot Security Certificate Report KSA-655925
- Inventory all workstations running KeyShot and prioritize patching for users who routinely import third-party CAD models
- Instruct designers and engineers to reject JT files from unverified sources until patching completes
- Restrict execution of KeyShot to standard user accounts to limit the blast radius of a successful exploit
Patch Information
Luxion has released an updated build of KeyShot that corrects the JT parser bounds handling. Refer to the KeyShot Security Certificate Report KSA-655925 and Zero Day Initiative Advisory ZDI-24-1612 for the vendor-supplied fixed version and installation guidance.
Workarounds
- Block .jt file attachments at the email gateway when senders are not on an approved allowlist
- Route third-party JT files through an isolated conversion workstation or sandbox before importing into production KeyShot instances
- Apply application control policies that prevent KeyShot from spawning shells, script interpreters, or unsigned binaries
- Enforce least privilege on design workstations so that any code execution occurs under a non-privileged account
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
