CVE-2025-61691: Keyence VT Studio RCE Vulnerability

CVE-2025-61691 Overview

CVE-2025-61691 is an out-of-bounds read vulnerability affecting Keyence VT STUDIO versions 8.53 and prior. The flaw is classified under [CWE-125] (Out-of-bounds Read) and can lead to arbitrary code execution when the product processes a specially crafted file. An attacker must persuade a local user to open a malicious project file, making this a file-format parsing weakness exploitable through social engineering. The vulnerability affects Keyence's HMI programming software used in industrial control system (ICS) environments, increasing the operational risk if exploited on engineering workstations.

Critical Impact
Arbitrary code execution on engineering workstations running VT STUDIO 8.53 or prior when a crafted project file is opened.

Affected Products

Keyence VT STUDIO versions 8.53 and prior
Keyence HMI development environments using affected VT STUDIO builds
Engineering workstations processing VT STUDIO project files

Discovery Timeline

2025-10-02 - CVE-2025-61691 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61691

Vulnerability Analysis

The vulnerability resides in VT STUDIO's file parsing logic. When the application processes a specially crafted project file, it reads memory outside the bounds of an allocated buffer. This out-of-bounds read can disclose adjacent memory contents and, depending on the parser's downstream use of the data, drive control flow into attacker-influenced code paths. The result is arbitrary code execution in the context of the user running VT STUDIO.

Exploitation requires local file access and user interaction. An attacker delivers a malicious VT STUDIO project file through email, removable media, or a shared engineering repository. Once the operator opens the file, the parser triggers the unsafe read and the payload executes with the privileges of the engineering workstation user.

The EPSS score is 0.127%, indicating a low probability of observed exploitation activity at the time of analysis. However, ICS engineering software is a recognized target for supply chain and lateral movement attacks against operational technology (OT) networks.

Root Cause

The root cause is missing or insufficient bounds validation when the parser reads structured fields from a VT STUDIO file. Crafted length, offset, or index values cause the parser to access memory beyond the intended buffer, producing the [CWE-125] condition.

Attack Vector

The attack vector is local with user interaction. An attacker cannot trigger the flaw remotely without delivering a file to the victim. Successful exploitation depends on convincing an engineer or operator to open the crafted file in a vulnerable VT STUDIO build.

No public proof-of-concept code is available. Refer to the JVN Security Advisory and the Keyence Vulnerability Report for vendor-confirmed technical context.

Detection Methods for CVE-2025-61691

Indicators of Compromise

Unexpected child processes spawned by VT STUDIO.exe such as cmd.exe, powershell.exe, or rundll32.exe
VT STUDIO project files received from untrusted sources or located outside standard engineering project directories
Crash dumps or Windows Error Reporting events referencing the VT STUDIO process on engineering workstations

Detection Strategies

Monitor process lineage on engineering workstations for VT STUDIO spawning interactive shells or scripting hosts
Inspect file shares and email gateways for inbound VT STUDIO project file types originating outside the organization
Alert on VT STUDIO process crashes followed by unusual outbound network connections from the same host

Monitoring Recommendations

Enable detailed process creation logging (Windows Event ID 4688 with command line auditing) on OT engineering hosts
Forward endpoint telemetry from engineering workstations into a centralized SIEM for cross-host correlation
Track file access events on directories used to store VT STUDIO project files

How to Mitigate CVE-2025-61691

Immediate Actions Required

Identify all hosts running VT STUDIO 8.53 or earlier and inventory their network exposure
Apply the Keyence-supplied fixed version as documented in the Keyence Vulnerability Report
Restrict opening of VT STUDIO project files to those originating from verified internal sources
Train engineering staff to validate the origin of any project file before opening

Patch Information

Keyence has published guidance for affected VT STUDIO users. Consult the Keyence Vulnerability Report and the JVN Security Advisory for the current fixed version and update procedure. Upgrade all engineering workstations to the remediated release as the primary mitigation.

Workarounds

Block VT STUDIO project file types at email and web gateways from untrusted senders
Segment engineering workstations from general corporate networks to limit lateral movement after compromise
Run VT STUDIO under a standard user account rather than an administrator to reduce impact of code execution

bash

# Example: audit hosts for vulnerable VT STUDIO installations on Windows
Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' |
  Where-Object { $_.DisplayName -like 'VT STUDIO*' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation