Remote Information Disclosure in Bentley ContextCapture

CVE-2021-34984

Summary

This vulnerability enables remote attackers to potentially disclose sensitive information from installations of Bentley ContextCapture, specifically version 10.18.0.232. The flaw arises during the parsing of OBJ files due to inadequate validation of user-supplied data. To exploit this vulnerability, an attacker needs the target user to visit a malicious webpage or open a compromised file. The consequence is a read past the end of an allocated buffer, which could allow an attacker to exploit other vulnerabilities, potentially leading to arbitrary code execution in the context of the current process.

References