{"id":"CVE-2026-92202","kind":"vulnerability","aliases":["CVE-2026-92202"],"related":[],"title":"Luxion KeyShot: BIP file parsing loads library from unsafe path","description":"Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of BIP files. The issue results from loading a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29268.","summary":"KeyShot loads a library from an insecure location while parsing BIP files. An attacker who gets a user to open a malicious file or visit a malicious page can run code in the KeyShot process.","severity":"high","cvss":7.8,"epss":0.00275,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-app","keyshot","other","windows"],"not_affected_if":["no-keyshot-installed"],"how_to_check":"- Check the installed KeyShot version against the vendor's advisory, which the sources do not name: unknown\n- Confirm whether KeyShot is installed on the machine: unknown","fix":"- Update KeyShot to a fixed release: unknown\n- Do not open untrusted BIP files until patched: unknown","status":"open","published_at":"2026-10-21T18:17:30+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:08:15+00:00","updated_at":"2026-10-25T03:08:15+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:08:15Z","model":"claude-haiku-5-5","output":{"fix":"- Update KeyShot to a fixed release: unknown\n- Do not open untrusted BIP files until patched: unknown","reach":"local","title":"Luxion KeyShot: BIP file parsing loads library from unsafe path","impact":"high","summary":"KeyShot loads a library from an insecure location while parsing BIP files. An attacker who gets a user to open a malicious file or visit a malicious page can run code in the KeyShot process.","category":"other","nicknames":[],"who_cares":["keyshot","windows","desktop-app"],"confidence":0.6,"needs_auth":"no","worst_case":"Code runs in the KeyShot process on the user's machine.","analyst_note":"Find affected KeyShot versions and the vendor fix in the Luxion advisory or the ZDI-CAN-29268 advisory; the NVD link lacks version details.","how_to_check":"- Check the installed KeyShot version against the vendor's advisory, which the sources do not name: unknown\n- Confirm whether KeyShot is installed on the machine: unknown","needs_analyst":true,"not_affected_if":["no-keyshot-installed"],"who_is_affected":"Teams that use Luxion KeyShot to open BIP files, especially from outside sources. Sources do not list affected versions. Systems without KeyShot installed are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000594,"input_tokens":3459,"output_tokens":497,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-92202':13A,16A '29268':149C 'affect':81C 'allow':73C 'app':19B 'arbitrari':78C 'attack':36B,75C,130C 'bip':3A,33B,60C,116C 'code':53B,68C,79C,137C 'context':140C 'current':143C 'cve':11A,14A 'desktop':18B 'desktop-app':17B 'element':66C 'execut':69C,77C,136C 'exist':111C 'exploit':91C 'file':4A,34B,45B,61C,107C,117C 'flaw':110C 'get':38B 'insecur':29B 'instal':82C 'interact':87C 'issu':119C 'keyshot':2A,20B,23B,56B,59C,85C 'leverag':132C 'librari':7A,26B,124C 'load':6A,24B,122C 'locat':30B,128C 'luxion':1A,58C,84C 'malici':44B,49B,101C,106C 'must':98C 'open':42B,104C 'page':50B,102C 'pars':5A,32B,62C,114C 'path':10A,65C 'process':57B,144C 'remot':67C,74C 'requir':89C 'result':120C 'run':52B 'search':64C 'specif':109C 'target':97C 'uncontrol':63C 'unsaf':9A 'unsecur':127C 'user':40B,86C 'visit':47B,99C 'vulner':70C,72C,93C,134C 'window':22B 'within':112C 'zdi':147C 'zdi-can':146C","nicknames":[],"mitigations":[],"who_affected":"Teams that use Luxion KeyShot to open BIP files, especially from outside sources. Sources do not list affected versions. Systems without KeyShot installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T18:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92202","severity":null,"published_at":"2026-10-21T18:17:30+00:00","modified_at":"2026-10-22T17:34:37+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-92202","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92202","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}