CVE-2021-22647: 
Homebrew vulnerability analysis and mitigation

CVE-2021-22647 affects Luxion KeyShot versions prior to 10.1, including KeyShot Viewer, KeyShot Network Rendering, and KeyVR versions. The vulnerability was discovered in early 2021 and involves multiple out-of-bounds write issues while processing project files. The vulnerability was assigned a CVSS v3 base score of 7.8, indicating a high severity level (CISA Advisory).

The vulnerability is characterized by multiple out-of-bounds write issues that occur during the processing of project files. The specific flaw exists within the parsing of various file types including FBX and CATPart files. The issue stems from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. The CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating local access, low attack complexity, no privileges required, and user interaction required (ZDI Advisory, CISA Advisory).

Successful exploitation of this vulnerability could allow attackers to execute arbitrary code in the context of the current process. The vulnerability enables attackers to execute arbitrary code, store arbitrary scripts into automatic startup folders, and attack products without sufficient UI warning (CISA Advisory).

The vulnerability requires user interaction to exploit, specifically the target must visit a malicious page or open a malicious file. The vulnerability has a low skill level requirement for exploitation. However, these vulnerabilities are not exploitable remotely, and there were no known public exploits specifically targeting these vulnerabilities at the time of disclosure (CISA Advisory, ZDI Advisory).

Luxion has released an update to KeyShot (v10.1) and recommends users update to the latest version. CISA recommends users take defensive measures to minimize the risk of exploitation and advises against clicking web links or opening unsolicited attachments in email messages (CISA Advisory).