Luxion KeyShot Vulnerability Allows Remote Code Execution via BIP File Parsing
A critical vulnerability in Luxion KeyShot's BIP file parsing allows remote attackers to execute arbitrary code on affected installations, requiring only user interaction.
A newly disclosed vulnerability in Luxion KeyShot, identified as ZDI-26-748 and assigned CVE-2026-92202, presents a significant risk of remote code execution (RCE) for users of the 3D rendering software. The flaw resides within the software's handling of BIP files, a proprietary format used by KeyShot for scene and project data.
Exploitation of this vulnerability requires a degree of user interaction. Attackers can trick unsuspecting users into opening a specially crafted malicious BIP file or by directing them to a malicious webpage that triggers the vulnerability. Once initiated, the vulnerability allows remote attackers to execute arbitrary code on the affected system. The severity of this flaw is underscored by its CVSS score of 7.8, classifying it as high.
The technical root cause of the vulnerability lies in an uncontrolled search path element within the BIP file parsing mechanism. Specifically, the software attempts to load a library from an unsecured location. An attacker can leverage this by manipulating the BIP file to point to a malicious library, which, when loaded, executes code within the context of the current KeyShot process. This means any privileges the user running KeyShot has could be leveraged by the attacker.
Luxion, the developer of KeyShot, has acknowledged the vulnerability and has released an update to address the issue. Security advisories and patch details can be found via a link provided by Luxion, indicating a proactive response to the disclosure. The disclosure timeline shows that the vulnerability was reported to the vendor on April 29, 2026, and a coordinated public release of the advisory occurred on September 23, 2026, with an update to the advisory on the same day.
The vulnerability was discovered and reported by Sean de Regge, highlighting the ongoing efforts of security researchers in identifying and mitigating such risks. The Zero Day Initiative (ZDI), a prominent bug bounty program, has coordinated the public disclosure of this advisory, ensuring that users are informed and can apply necessary patches.
While the vulnerability requires user interaction, the potential impact of remote code execution is severe. It could lead to complete system compromise, data theft, or the deployment of further malicious software. Users of Luxion KeyShot are strongly advised to apply the available update as soon as possible to protect themselves from potential exploitation.
This incident is part of a broader trend of vulnerabilities being discovered in complex software applications, particularly those that handle user-provided or externally sourced files. The nature of the flaw, involving file parsing and library loading, is a common vector for RCE vulnerabilities across various software categories, from document readers to creative tools.
Organizations and individuals relying on Luxion KeyShot should prioritize applying the security update provided by the vendor. Verifying the integrity of downloaded BIP files and exercising caution when opening files from untrusted sources are also crucial steps in mitigating the risk associated with this and similar vulnerabilities.