CVE-2025-7222

Executive Summary

CVE-2025-7222 is a critical Out-Of-Bounds Write vulnerability in Luxion KeyShot's parsing of 3DM files. This flaw allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required, as the target must visit a malicious page or open a malicious file. The vulnerability stems from improper validation of user-supplied data during 3DM file parsing, leading to a write past the end of an allocated buffer. An attacker can leverage this to execute code in the context of the current process. The vulnerability was reported as ZDI-CAN-26473.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a standalone desktop application (Luxion KeyShot) and its 3DM file parsing component. Supply chain risks are limited to the distribution of malicious 3DM files via email, downloads, or shared storage.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: Local (requires user to open a malicious file)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. The vulnerability allows full code execution with the privileges of the current user. Exploitation requires user interaction, but the attack vector is simple (opening a malicious 3DM file).

Deep Dive & Mechanics

The vulnerability exists in the 3DM file parsing module of Luxion KeyShot. 3DM files are native to Rhino 3D but can be imported by KeyShot. The specific flaw is an out-of-bounds write (CWE-787) that occurs when the parser processes a crafted 3DM file.

Root Cause: The parser does not properly validate the size or offset of data blocks within the 3DM file. When reading a specific data structure, the code calculates a write destination based on attacker-controlled values without checking if the destination falls within the allocated buffer. This results in a write past the end of the buffer.

Attack Vector: An attacker crafts a malicious 3DM file containing a specially crafted data block. When KeyShot parses this file, the out-of-bounds write overwrites adjacent memory, potentially corrupting critical data structures or function pointers. This can lead to arbitrary code execution.

Impact: Successful exploitation allows the attacker to execute arbitrary code in the context of the KeyShot process. This can lead to data theft, installation of malware, or further compromise of the system.

Vulnerable vs. Patched Code

Since no official patch is available, a direct code comparison is not possible. However, the vulnerable code likely resembles:

// Vulnerable pseudo-code
void Parse3DMBlock(char* buffer, size_t bufferSize, uint32_t offset, uint32_t size) {
    char* dest = buffer + offset; // No bounds check on offset
    memcpy(dest, someData, size); // No bounds check on size
}

A patched version would include bounds checking:

// Patched pseudo-code
void Parse3DMBlock(char* buffer, size_t bufferSize, uint32_t offset, uint32_t size) {
    if (offset + size > bufferSize) {
        // Handle error
        return;
    }
    char* dest = buffer + offset;
    memcpy(dest, someData, size);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Luxion KeyShot installed (any version)
• Ability to deliver a malicious 3DM file to the target

Exploitation Steps:

1. Craft a malicious 3DM file using a tool like 3dm_exploit_builder.py (hypothetical).
2. Deliver the file via email, download link, or shared drive.
3. Convince the target to open the file in KeyShot.
4. The exploit triggers the out-of-bounds write, overwriting a function pointer or return address.
5. Code execution is achieved, and a payload (e.g., reverse shell) is executed.

Example Payload (Python):

# Hypothetical exploit script
import struct

def build_malicious_3dm():
    # Craft a 3DM file with a malicious block
    # This is a simplified example
    payload = b"A" * 1000  # Overflow data
    # ... build 3DM structure with oversized block
    return payload

with open("malicious.3dm", "wb") as f:
    f.write(build_malicious_3dm())

Blue Team (Defense)

Detection:

• Monitor for unusual 3DM files being opened by KeyShot.
• Use file integrity monitoring to detect changes to KeyShot binaries.
• Deploy endpoint detection and response (EDR) solutions to detect exploitation behavior.

Prevention:

• Restrict execution of KeyShot to trusted users only.
• Use application whitelisting to prevent unauthorized executables.
• Implement network segmentation to limit lateral movement.

Hunting:

• Search for processes spawning from KeyShot (e.g., cmd.exe, powershell.exe).
• Look for unusual network connections originating from the KeyShot process.
• Analyze crash dumps for signs of heap corruption or out-of-bounds writes.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available publicly)
• Network Indicators: Connections to unknown IP addresses from KeyShot process
• Process Indicators: KeyShot.exe spawning cmd.exe, powershell.exe, or other shells
• File Indicators: Malicious 3DM files with unusual size or structure
• Registry Keys: (None specific)
• YARA Rule: See Detection Engineering section

Detection Engineering

YARA Rule

rule CVE_2025_7222_Keyshot_3DM_OOBW {
    meta:
        description = "Detects malicious 3DM files targeting CVE-2025-7222"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-7222"
    strings:
        $header = "3D Model" ascii wide nocase
        $magic = { 4D 4F 44 45 } // "MODE" in hex
        $overflow = { 41 41 41 41 } // Pattern of A's (potential overflow)
    condition:
        $header and $magic and #overflow > 100
}

Sigma Rule

title: CVE-2025-7222 - Luxion KeyShot 3DM File Parsing OOBW
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2025-7222 via malicious 3DM files
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-7222
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\KeyShot.exe'
        CommandLine|contains:
            - 'cmd.exe'
            - 'powershell.exe'
            - 'wscript.exe'
            - 'cscript.exe'
    condition: selection
falsepositives:
    - Legitimate use of scripting from KeyShot (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-7222 - Luxion KeyShot 3DM File Parsing OOBW"; flow:to_server,established; content:"|4D 4F 44 45|"; offset:0; depth:4; content:"|41 41 41 41|"; within:1000; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. No official patch available. Monitor Luxion KeyShot updates and apply when released.
2. Restrict file access: Block 3DM files from untrusted sources via email and web gateways.
3. User awareness: Train users not to open 3DM files from unknown or untrusted sources.
4. Application control: Use AppLocker or similar to prevent KeyShot from executing untrusted scripts.

Long-term Mitigation:

1. Vendor patch: Apply the official patch when released by Luxion.
2. Sandboxing: Run KeyShot in a sandboxed environment to limit impact.
3. Network segmentation: Isolate systems running KeyShot from critical infrastructure.

Workarounds:

• Disable 3DM file import if not needed (check KeyShot settings).
• Use a different 3D viewer for untrusted 3DM files.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert