CVE-2026-82918: Improper restriction of XML external entity reference in Keyence Corporation XG-X VisionTerminal

Keyence Corporation's XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software, and WI Series Terminal-Software improperly restrict XML external entity references, allowing an attacker to craft a malicious setting file that, when opened by a user, can disclose sensitive information stored on the affected system. The CVSS 3.1 base score is 5.5 (medium), with attack vector local, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact. No known exploits are reported in the wild. No patch or remediation information is provided in the source data.

Successful exploitation can lead to disclosure of sensitive information stored on the system where the affected software is installed. There is no impact on integrity or availability. The attack requires local access and user interaction, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid opening untrusted or specially crafted setting files with the affected software. Monitor vendor communications for updates on patches or official mitigations.