Luxion KeyShot can be tricked into loading a library from an unsecured location when it parses .bip files, which allows a remote attacker to execute code with the same privileges as the current user. The flaw is triggered purely in the file parsing routine; it does not require any privileged system access beforehand. Because the attack vector involves a malicious file, user interaction is required—either the user must open the file or visit a web page that initiates the file opening.

The vulnerability affects Luxion:KeyShot. No specific version range is listed in the advisory, so the issue may exist in all supported releases of KeyShot until a fix is applied. Administrators should verify the installed version against the vendor’s release notes for a confirmed fix.

The CVSS score of 7.8 places the flaw in the High category, indicating significant potential impact. The EPSS score is not available, so the current exploitation probability is unclear. It is not listed in the CISA KEV catalog; however, the remote code execution possibility combined with the need for user interaction means it could be targeted by phishing or social engineering campaigns. The attack path requires the victim to open a crafted .bip file or allow the application to load external libraries during parsing.