Luxion KeyShot: Remote code execution via untrusted library loading in BIP parsing
Summary
Luxion KeyShot loads a library from an unsecured location while parsing BIP project files. An attacker who gets a user to open a malicious BIP file or visit a malicious page can execute code in the context of the current KeyShot process. No authentication is required, but user interaction is needed. The vendor has issued an update, but the fixed version could not be verified in the research.
Affected
- KeyShot 2026.1.0 (CNA data; other versions unknown)
- Vendor-stated scope not verified; OpenCVE suggests all supported releases may be affected until fixed
Fixed in
- Luxion has issued an update per ZDI; fixed version: Unknown. Check vendor advisory ksa-302860.
Workaround
- Unknown from vendor sources.
- Only open BIP files from trusted sources.
- Third-party suggestion (unverified): restrict library search paths or disable automatic loading of external libraries via group policy or local security settings.
Exploitation
- No public proof of concept or in-the-wild exploitation found.
- Not listed in CISA KEV.
- EPSS below 1%.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Read vendor advisory ksa-302860 and record the fixed version.
- Inventory all KeyShot installations, including copies bundled in other software, and note their versions.
- Update KeyShot to the fixed version as soon as possible.
- Until patched, open BIP and KSP files only from trusted sources.
- Recheck NVD, CISA KEV and the ZDI advisory for exploitation reports.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ZDI-26-748 advisory www.zerodayinitiative.com
- Luxion advisory ksa-302860 download.keyshot.com
- OpenCVE CVE-2026-92202 app.opencve.io
- SystemTek news article www.systemtek.co.uk
- Siemens SSA-119468 (related KeyShot bundling) cert-portal.siemens.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:46.
Original description (NVD)
Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BIP files. The issue results from loading a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29268.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.