CVE-2025-1046

Luxion KeyShot SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23646.

• CWE-416

• https://download.keyshot.com/cert/ksa-113962/ksa-113962.pdf?version=1.0&_gl=1*1x6i3a*_gcl_au*MTU0ODMwNDI4Ny4xNzQzNTUyMjcxVendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-25-231/Third Party Advisory

Published

Apr 23, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-10452Statistical Database System developed by Gotac has a Missing…9.8
• CVE-2025-10453O'View MapServer developed by PilotGaea Technologies has a S…6.9
• CVE-2025-10456A vulnerability was identified in the handling of Bluetooth …6.5
• CVE-2025-10457The function responsible for handling BLE connection respons…8.1
• CVE-2025-10458Parameters are not validated or sanitized, and are later use…7.6
• CVE-2025-10459A security flaw has been discovered in PHPGurukul Beauty Par…9.8
• CVE-2025-10460A SQL Injection vulnerability on an endpoint in BEIMS Contra…9.4
• CVE-2025-10461Global file reads caused by improper URL checks in webserver…5.3
• CVE-2025-10463Improper Authentication vulnerability in Birtech Information…7.3
• CVE-2025-10464Insecure Storage of Sensitive Information vulnerability in B…6.5
• CVE-2025-10465Unrestricted Upload of File with Dangerous Type vulnerabilit…8.8
• CVE-2025-10466Improper neutralization of input during web page generation …5.9