CVE-2021-27496: 
Homebrew vulnerability analysis and mitigation

CVE-2021-27496 is a vulnerability affecting Datakit Software libraries (CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules) in KeyShot Versions v10.1 and prior. The vulnerability was discovered in 2021 and involves an untrusted pointer dereference issue when parsing PRT files. The affected software lacks proper validation of user-supplied data, which could lead to pointer dereferences of values obtained from untrusted sources (NVD, ZDI).

The vulnerability is classified as an Untrusted Pointer Dereference (CWE-822) with a CVSS v3.1 base score of 7.8 (High) and vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The specific flaw exists within the parsing of PRT files, where the application fails to properly validate user-supplied values before dereferencing them as pointers (ZDI, ICS-CERT).

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code in the context of the current process. The vulnerability requires user interaction, as the target must visit a malicious page or open a malicious file (ZDI, ICS-CERT).

The vulnerability requires local access and user interaction to exploit. There are no known public exploits specifically targeting this vulnerability, and it is not exploitable remotely (ICS-CERT).

Datakit has released CrossCAD/Ware library Version 2021.2 to address this vulnerability. Luxion has released KeyShot v10.2, which includes the updated Datakit libraries. Users are recommended to upgrade to these latest versions. Additionally, users should avoid opening untrusted files from unknown sources (ICS-CERT).