CVE-2025-58775: KV STUDIO Buffer Overflow Vulnerability

CVE-2025-58775 Overview

CVE-2025-58775 is a stack-based buffer overflow vulnerability [CWE-121] affecting Keyence KV STUDIO and VT5-WX15/WX12 products. The flaw allows arbitrary code execution when the affected product opens a specially crafted file. Attackers must convince a local user to open a malicious project or configuration file, making user interaction a requirement for exploitation.

Critical Impact
Successful exploitation enables arbitrary code execution in the context of the engineering software, providing attackers a foothold inside operational technology (OT) engineering workstations used for programmable logic controller (PLC) and HMI development.

Affected Products

Keyence KV STUDIO
Keyence VT5-WX15
Keyence VT5-WX12

Discovery Timeline

2025-10-02 - CVE-2025-58775 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-58775

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow [CWE-121] in Keyence engineering software. When the product parses a specially crafted file, attacker-controlled data overflows a fixed-size stack buffer. This corrupts adjacent stack memory, including the saved return address and structured exception handlers.

Because the overflow occurs on the stack, attackers can hijack control flow and execute arbitrary code with the privileges of the user running the application. The attack vector is local and requires user interaction to open the malicious file. The exploitation profile is consistent with engineering workstation targeting common in OT-focused intrusions.

Root Cause

The root cause is improper validation of input length when reading values from a file into a fixed-size stack buffer. The parser fails to enforce boundary checks before performing the copy operation, allowing oversized fields to overwrite adjacent stack frame data.

Attack Vector

An attacker crafts a malicious project, configuration, or screen-data file consumed by KV STUDIO or the VT5-WX15/WX12 software. The file is delivered through phishing, removable media, supply chain compromise, or shared engineering repositories. When an engineer opens the file, the parser triggers the overflow and executes attacker-supplied shellcode.

No proof-of-concept exploit code is publicly available. Technical details are described in the JVN Vulnerability Report and the Keyence Security Vulnerability advisory.

Detection Methods for CVE-2025-58775

Indicators of Compromise

Unexpected child processes spawned by KV STUDIO or VT5 software, particularly command interpreters such as cmd.exe, powershell.exe, or rundll32.exe.
Crash artifacts, Windows Error Reporting entries, or application event log errors referencing access violations in Keyence binaries.
Inbound transfer of .kpr, project, or screen-data files from untrusted email, USB, or network shares immediately before anomalous host activity.

Detection Strategies

Monitor process lineage on engineering workstations and alert on Keyence applications spawning scripting hosts, network utilities, or LOLBins.
Inspect file metadata and entropy on inbound project files to identify malformed or oversized field structures consistent with overflow payloads.
Correlate user interaction events (file open) with subsequent outbound network connections from the engineering application.

Monitoring Recommendations

Forward endpoint process telemetry and Windows event logs from OT engineering hosts to a centralized analytics platform for behavioral baselining.
Track file shares and source-code repositories holding Keyence project files for unauthorized writes or unusual modifications.
Enable application crash reporting on engineering workstations and review crashes in Keyence processes as potential exploitation attempts.

How to Mitigate CVE-2025-58775

Immediate Actions Required

Apply the fixed versions of KV STUDIO and VT5-WX15/WX12 referenced in the Keyence advisory as soon as they are validated for your environment.
Restrict engineering workstations to opening project files only from trusted, signed sources and known-good repositories.
Train engineering staff to treat unsolicited project, configuration, or screen-data files as untrusted attachments.

Patch Information

Keyence has published vendor guidance and fixed software versions. Refer to the Keyence Security Vulnerability advisory and the JVN Vulnerability Report for the authoritative list of affected versions and the corresponding updates.

Workarounds

Segment engineering workstations from corporate email and general internet access to reduce malicious file delivery paths.
Enforce application allowlisting and block execution of unauthorized child processes spawned by Keyence software.
Require multi-party review of project files before they are loaded into production engineering tools.

bash

# Configuration example
# No vendor-supplied configuration mitigation is published.
# Apply the fixed software version per the Keyence advisory:
# https://www.keyence.com/kv_vulnerability2509301