---
id: "CVE-2026-92202"
kind: "vulnerability"
aliases: ["CVE-2026-92202"]
title: "Luxion KeyShot: BIP file parsing loads library from unsafe path"
severity: "high"
cvss: 7.8
epss: 0.00275
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["desktop-app", "keyshot", "other", "windows"]
not_affected_if: ["no-keyshot-installed"]
published_at: "2026-10-21T18:17:30+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:08:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92202", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-92202", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Luxion KeyShot: BIP file parsing loads library from unsafe path

KeyShot loads a library from an insecure location while parsing BIP files. An attacker who gets a user to open a malicious file or visit a malicious page can run code in the KeyShot process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed KeyShot version against the vendor's advisory, which the sources do not name: unknown
- Confirm whether KeyShot is installed on the machine: unknown

## Fix

- Update KeyShot to a fixed release: unknown
- Do not open untrusted BIP files until patched: unknown

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92202
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-92202

## From the sources

Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of BIP files. The issue results from loading a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29268.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_