Remote Code Execution in Bentley MicroStation CONNECT

CVE-2022-28301

Summary

A vulnerability in Bentley MicroStation CONNECT allows remote attackers to execute arbitrary code by exploiting the parsing process of IFC files. This occurs when the target users interact with malicious content, such as visiting compromised web pages or opening specially crafted files. The flaw results in a buffer overflow, enabling an attacker to write past the end of an allocated buffer and execute code within the context of the affected process, potentially leading to further exploitation.

References