CVE-2024-29219: Keyence KV Replay Viewer Info Disclosure

CVE-2024-29219 Overview

CVE-2024-29219 is an out-of-bounds read vulnerability [CWE-125] affecting multiple Keyence industrial automation products. The flaw resides in KV STUDIO Ver.11.64 and earlier, KV REPLAY VIEWER Ver.2.64 and earlier, and VT5-WX15/WX12 firmware Ver.6.02 and earlier. An attacker can trigger the condition by convincing an operator to open a specially crafted project file. Successful exploitation may result in information disclosure or arbitrary code execution in the context of the current user. Because these products are widely deployed in operational technology (OT) environments, exploitation can pivot from an engineering workstation into control networks.

Critical Impact
Local exploitation via a malicious file can lead to arbitrary code execution or memory disclosure on engineering workstations used to program Keyence PLCs and HMIs.

Affected Products

Keyence KV STUDIO Ver.11.64 and earlier
Keyence KV REPLAY VIEWER Ver.2.64 and earlier
Keyence VT5-WX15 and VT5-WX12 firmware Ver.6.02 and earlier

Discovery Timeline

2024-04-15 - CVE-2024-29219 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29219

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] triggered when the affected Keyence applications parse a crafted project or replay file. The parser reads memory beyond the intended buffer boundary, exposing adjacent process memory or corrupting control-flow data used later during file processing. Depending on the memory layout, this can yield sensitive data leakage or divert execution into attacker-controlled code paths.

Exploitation requires user interaction: an operator or engineer must open a malicious file in KV STUDIO, KV REPLAY VIEWER, or the VT5-WX15/WX12 project loader. No network access or authentication is required, and the attack vector is local.

Root Cause

The root cause is missing or insufficient bounds validation while parsing structured fields within Keyence project files. When length or offset values embedded in the file are not validated against the allocated buffer size, the parser reads past the end of the buffer. This class of defect is common in binary format parsers that trust size fields declared inside the file.

Attack Vector

An attacker crafts a malicious KV STUDIO, KV REPLAY VIEWER, or VT5 project file with manipulated length or offset fields. The file is delivered through phishing, shared engineering repositories, USB media, or supply-chain contamination of project templates. When a legitimate user opens the file in the vulnerable application, the parser dereferences memory outside the intended buffer, producing either an information leak or memory corruption suitable for code execution.

No verified proof-of-concept code has been published. Refer to the JVN Vulnerability Report and the Keyence Vulnerability Advisory #240329 for vendor-supplied technical detail.

Detection Methods for CVE-2024-29219

Indicators of Compromise

Unexpected KV STUDIO or KV REPLAY VIEWER process crashes recorded in the Windows Application event log on engineering workstations.
Project files (.kpr, .rep, VT5 project archives) arriving from untrusted email senders, external drives, or unmanaged file shares.
Child processes spawned by KV STUDIO.exe or KVReplayViewer.exe that are inconsistent with normal engineering activity.

Detection Strategies

Monitor engineering workstations for anomalous process lineage originating from Keyence executables, including command interpreters, script hosts, or network utilities.
Alert on file-open telemetry where KV STUDIO or KV REPLAY VIEWER loads project files from user-writable locations such as Downloads, Temp, or removable media.
Correlate crash events (Windows Error Reporting) with subsequent outbound network connections or persistence artifacts.

Monitoring Recommendations

Baseline normal behavior of Keyence engineering tools and flag deviations such as unexpected DLL loads or memory allocation anomalies.
Ingest endpoint telemetry from OT engineering workstations into a centralized analytics platform to enable retrospective hunting once new indicators are published.
Track versions of Keyence software deployed across the fleet to identify systems still running Ver.11.64, Ver.2.64, or firmware Ver.6.02 and earlier.

How to Mitigate CVE-2024-29219

Immediate Actions Required

Identify all endpoints running KV STUDIO, KV REPLAY VIEWER, or interacting with VT5-WX15/WX12 units and inventory their installed versions.
Apply the vendor updates referenced in the Keyence Vulnerability Advisory #240329 and Keyence Vulnerability Advisory #240924.
Restrict opening of untrusted project files on engineering workstations and validate origin before load.

Patch Information

Keyence has published fixed versions superseding KV STUDIO Ver.11.64, KV REPLAY VIEWER Ver.2.64, and VT5-WX15/WX12 firmware Ver.6.02. Consult the Keyence Vulnerability Advisory #240329 and Keyence Vulnerability Advisory #240924 for exact fixed version numbers and download instructions. The JVN Vulnerability Report provides additional coordination detail.

Workarounds

Only open project files received from trusted, verified sources; block delivery of Keyence project file extensions from external email.
Segment engineering workstations from general corporate networks and enforce least-privilege user accounts for operators running Keyence tools.
Disable auto-open handlers or file previewers for Keyence file types until patches are applied across the fleet.

bash

# Example: enumerate installed KV STUDIO versions across Windows workstations
Get-CimInstance -ClassName Win32_Product |
  Where-Object { $_.Name -match 'KV STUDIO|KV REPLAY VIEWER' } |
  Select-Object Name, Version, InstallDate