CVE-2025-2532: Luxion KeyShot USDC Parsing RCE Flaw

CVE-2025-2532 Overview

CVE-2025-2532 is a use-after-free vulnerability [CWE-416] in Luxion KeyShot affecting the parsing of Universal Scene Description Crate (.usdc) files. The flaw allows remote attackers to execute arbitrary code on affected installations. Exploitation requires user interaction: the target must open a malicious file or visit a page that delivers one. The issue stems from the lack of validating an object's existence before performing operations on it. This vulnerability was reported through the Zero Day Initiative as ZDI-CAN-23709.

Critical Impact
Successful exploitation allows an attacker to execute arbitrary code in the context of the current user process, resulting in full compromise of confidentiality, integrity, and availability on the affected workstation.

Affected Products

Luxion KeyShot 2024.13.0.0
Luxion KeyShot installations processing USDC files
Workstations running vulnerable KeyShot versions

Discovery Timeline

2025-03-25 - CVE-2025-2532 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2532

Vulnerability Analysis

The vulnerability resides in the code path that parses Universal Scene Description Crate (.usdc) files within Luxion KeyShot. USDC is a binary serialization format used to describe 3D scene data. During parsing, KeyShot performs operations on an object without first verifying that the object exists. When a crafted USDC file references a freed or non-existent object, the parser dereferences a dangling pointer.

This use-after-free condition [CWE-416] enables an attacker who controls the freed memory contents to hijack control flow. The result is arbitrary code execution in the process context of the user running KeyShot. Because KeyShot commonly runs with standard user privileges on designer and engineering workstations, successful exploitation grants the attacker equivalent access to sensitive project files and network resources.

Root Cause

The root cause is missing object-existence validation prior to method invocation or field access during USDC deserialization. The parser assumes referenced objects are valid without checking their lifecycle state. When the object has been freed or was never allocated, subsequent operations dereference stale memory.

Attack Vector

Exploitation requires local file processing but the delivery vector is remote. An attacker crafts a malicious .usdc file and delivers it through email attachments, file-sharing services, or a web page. The victim must open the file in KeyShot or visit a page that triggers file handling. Once opened, the malformed object references trigger the use-after-free and execute the attacker-controlled payload.

No verified public proof-of-concept exploit is available at this time. See the Zero Day Initiative Advisory ZDI-25-175 for additional technical context.

Detection Methods for CVE-2025-2532

Indicators of Compromise

Unexpected .usdc files arriving through email or download channels from untrusted sources
KeyShot process crashes or abnormal terminations when opening 3D asset files
Child processes spawned by keyshot.exe that are inconsistent with normal rendering workflows
Outbound network connections initiated by KeyShot to previously unseen hosts following file open events

Detection Strategies

Monitor endpoint telemetry for KeyShot processes spawning command interpreters (cmd.exe, powershell.exe) or scripting hosts
Alert on memory access violations and exception events originating from KeyShot USDC parsing modules
Inspect email and web gateway logs for .usdc file transfers from external senders
Correlate file-open events on .usdc extensions with subsequent process injection or credential access behaviors

Monitoring Recommendations

Log all executions of KeyShot with associated command-line arguments and parent-child process relationships
Enable file integrity monitoring on the KeyShot installation directory to detect unauthorized modifications
Capture and retain crash dumps from KeyShot processes for forensic analysis
Track network egress from workstations running KeyShot for anomalous destinations following file processing

How to Mitigate CVE-2025-2532

Immediate Actions Required

Restrict opening of .usdc files to those from trusted, verified sources only
Apply application allowlisting to prevent KeyShot from spawning unexpected child processes
Run KeyShot under standard user accounts without administrative privileges to limit blast radius
Review incoming email and file-sharing traffic for USDC attachments and quarantine files from unknown senders

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-25-175 and the Luxion vendor site for the latest patched release of KeyShot. Upgrade all instances of KeyShot 2024.13.0.0 to a fixed version as soon as it becomes available from Luxion.

Workarounds

Block .usdc file attachments at email and web gateways until patches are deployed
Disable file association handlers that automatically open USDC files in KeyShot from browsers or mail clients
Isolate design workstations running KeyShot on segmented network zones with restricted outbound access
Educate designers and engineers to validate USDC file provenance before opening in KeyShot

bash

# Example: block .usdc attachments at a mail gateway (Postfix header_checks)
/^Content-(Disposition|Type).*name\s*=\s*"?[^"]*\.usdc"?/  REJECT USDC attachments blocked pending CVE-2025-2532 patch