CVE-2026-92202: Luxion KeyShot BIP File Parsing Flaw Enables Code Execution — Detection and Hardening Guide

---
title: Luxion KeyShot DLL Loaded From User-Writable Path
id: 3f8a1c47-9b2e-4d5a-a671-0c8e2f4b9d13
status: experimental
description: Detects keyshot.exe loading a DLL from a user-writable or non-installation directory, consistent with CVE-2026-92202 uncontrolled search path exploitation via a malicious BIP package.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-748/
  - https://attack.mitre.org/techniques/T1574/001/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection_image:
    Image|endswith: '\keyshot.exe'
  selection_path:
    ImageLoaded|contains:
      - '\Downloads\'
      - '\Desktop\'
      - '\Temp\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\\'
      - '\Users\Public\'
  filter_legit:
    ImageLoaded|contains:
      - '\AppData\Roaming\Luxion\'
      - '\AppData\Local\Luxion\'
  condition: selection_image and selection_path and not filter_legit
falsepositives:
  - KeyShot plugins legitimately installed under the user's Luxion AppData directories
  - Corporate rendering-farm tooling deployed outside Program Files
level: high
---
title: KeyShot Process Spawning Command or Script Interpreter
id: 8c2d5e91-4a7f-4b38-9e62-1f5a7c3d8024
status: experimental
description: Detects keyshot.exe spawning command shells, script interpreters, or LOLBins. A signed CAD application launching cmd, PowerShell, rundll32, or mshta is a strong post-exploitation indicator following malicious BIP file execution (CVE-2026-92202).
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-748/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\keyshot.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare: KeyShot network-rendering helper scripts in managed render-farm deployments
level: critical
---
title: BIP Package File Created by Browser or Email Client
id: 5e1b9f36-7c48-4d2a-b893-6a0d4e71c935
status: experimental
description: Detects creation of .bip (KeyShot Package) files by browsers or email clients, highlighting inbound delivery of potentially malicious KeyShot packages associated with CVE-2026-92202 social-engineering lures.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-748/
  - https://attack.mitre.org/techniques/T1566/001/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: file_event
  product: windows
detection:
  selection_file:
    TargetFilename|endswith: '.bip'
  selection_source:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\OUTLOOK.EXE'
      - '\thunderbird.exe'
  condition: selection_file and selection_source
falsepositives:
  - Legitimate BIP file exchange between designers and external suppliers
level: medium

// Hunt: KeyShot suspicious module loads, child processes, and inbound BIP files (CVE-2026-92202)
let Lookback = 14d;
let SuspiciousLoadPaths = dynamic(["\\Downloads\\", "\\Desktop\\", "\\Temp\\", "\\AppData\\Local\\Temp\\", "\\Users\\Public\\", "\\\\"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe"]);
let KeyShotImageLoads =
    DeviceImageLoadEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName =~ "keyshot.exe"
    | where FolderPath has_any (SuspiciousLoadPaths)
    | where not(FolderPath has "\\AppData\\Roaming\\Luxion\\")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FolderPath, SHA256, Signal="Suspicious DLL load by keyshot.exe";
let KeyShotChildren =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName =~ "keyshot.exe"
    | where FileName in~ (SuspiciousChildren)
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName, Signal="keyshot.exe spawned interpreter/LOLBin";
let InboundBip =
    DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName endswith ".bip"
    | where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "OUTLOOK.EXE", "thunderbird.exe")
    | project TimeGenerated, DeviceName, FolderPath, SHA256, InitiatingProcessFileName, Signal="BIP file delivered via browser/email";
union KeyShotImageLoads, KeyShotChildren, InboundBip
| sort by TimeGenerated desc

-- Hunt: KeyShot BIP packages and co-located DLLs in user-writable directories (CVE-2026-92202)
-- Look for BIP files in delivery locations
LET bip_files = SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=['C:/Users/*/Downloads/**/*.bip',
                 'C:/Users/*/Desktop/**/*.bip',
                 'C:/Users/*/AppData/Local/Temp/**/*.bip'])
WHERE Mtime > now() - 1209600

-- Look for DLLs staged alongside BIP files in the same delivery locations
LET staged_dlls = SELECT FullPath, Size, Mtime
FROM glob(globs=['C:/Users/*/Downloads/**/*.dll',
                 'C:/Users/*/Desktop/**/*.dll',
                 'C:/Users/*/AppData/Local/Temp/**/*.dll'])
WHERE Mtime > now() - 1209600

-- Correlate: any keyshot.exe process with DLLs loaded from outside Program Files
SELECT * FROM {
    SELECT 'BIP_File' AS ArtifactType, FullPath, Size, Mtime FROM bip_files
} UNION {
    SELECT 'Staged_DLL' AS ArtifactType, FullPath, Size, Mtime FROM staged_dlls
} UNION {
    SELECT 'Suspicious_Load' AS ArtifactType,
           Exe AS FullPath, 0 AS Size, CreateTime AS Mtime
    FROM pslist()
    WHERE Name =~ 'keyshot' AND Exe !~ 'Program Files'
}

# CVE-2026-92202 - KeyShot Uncontrolled Search Path Mitigation & Verification
# Run as Administrator

# --- 1. Inventory installed KeyShot versions ---
Write-Host "[*] Inventorying KeyShot installations..." -ForegroundColor Cyan
$keyshot = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
           "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" -ErrorAction SilentlyContinue |
           Where-Object { $_.DisplayName -match "KeyShot" } |
           Select-Object DisplayName, DisplayVersion, InstallLocation
if ($keyshot) { $keyshot | Format-Table -AutoSize } else { Write-Host "[+] No KeyShot installation found." }

# --- 2. OS-level DLL search-order hardening (mitigates CWE-427 class) ---
# SafeDllSearchMode: removes CWD from the standard search order priority
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name "SafeDllSearchMode" -Value 1 -Type DWord
Write-Host "[+] SafeDllSearchMode enabled."

# CWDIllegalInDllSearch = 2: block DLL loads from the current working directory
# This directly blunts document-adjacent DLL hijacking like the BIP parsing flaw
New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name "CWDIllegalInDllSearch" -PropertyType DWord -Value 2 -Force | Out-Null
Write-Host "[+] CWDIllegalInDllSearch set to 2 (block CWD DLL loads)."

# --- 3. Enable Sysmon-relevant auditing: process creation with command line ---
New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" -Name "ProcessCreationIncludeCmdLine_Enabled" -Value 1 -Type DWord
auditpol /set /subcategory:"Process Creation" /success:enable | Out-Null
Write-Host "[+] Command-line process auditing enabled."

# --- 4. Report BIP files in high-risk delivery locations for review ---
Write-Host "[*] Scanning for .bip files in Downloads/Desktop/Temp (last 30 days)..." -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-30)
Get-ChildItem -Path "$env:SystemDrive\Users" -Recurse -Filter "*.bip" -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt $cutoff -and $_.FullName -match "Downloads|Desktop|Temp" } |
    Select-Object FullName, LastWriteTime, @{N='SizeMB';E={[math]::Round($_.Length/1MB,2)}} |
    Format-Table -AutoSize

Write-Host "[*] Complete. Reboot required for DLL search-order changes to take full effect." -ForegroundColor Green
Write-Host "[!] ACTION REQUIRED: Update KeyShot to the vendor-fixed build per ZDI-26-748." -ForegroundColor Yellow