CVE-2021-22649: 
Homebrew vulnerability analysis and mitigation

Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 contain an untrusted pointer dereference vulnerability (CVE-2021-22649). The vulnerability was discovered in early 2021 and involves multiple NULL pointer dereference issues while processing project files, which could potentially lead to arbitrary code execution (CISA Advisory).

The vulnerability has been assigned a CVSS v3 base score of 7.8 (High) with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The specific flaw exists within the parsing of project files, where the issue results from the lack of proper validation of user-supplied values prior to dereferencing them as pointers. The vulnerability requires user interaction to exploit, such as opening a malicious file (ZDI Advisory, CISA Advisory).

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code in the context of the current process. The vulnerability affects multiple Luxion products and could potentially lead to complete system compromise if successfully exploited (CISA Advisory).

The vulnerability requires low skill level to exploit but needs user interaction, such as opening a malicious file or visiting a malicious page. The vulnerability is not exploitable remotely, and there are no known public exploits specifically targeting this vulnerability (CISA Advisory).

Luxion has released an update to KeyShot (v10.1) and recommends users update to the latest version. CISA recommends users take defensive measures to minimize the risk of exploitation and advises against clicking web links or opening unsolicited attachments in email messages (CISA Advisory).