Remote Code Execution Vulnerability in Luxion KeyShot Software
CVE-2026-92202

7.8HIGH

Key Information:

Vendor

Luxion

Status
Keyshot
Vendor
CVE Published:
21 October 2026

What is CVE-2026-92202?

This vulnerability affects the parsing mechanism of BIP files in Luxion KeyShot, allowing malicious actors to execute arbitrary code by loading libraries from unsecured locations. Exploitation requires user interaction, such as visiting a compromised webpage or opening a manipulated file. This flaw may have serious implications for user systems, highlighting the need for timely patching and awareness of safe file handling practices.

Affected Version(s)

KeyShot 2026.1.0

References

https://www.zerodayinitiative.com/advisories/ZDI-26-748/
x_research-advisory
https://download.keyshot.com/cert/ksa-302860/ksa-302860.p...
vendor-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.