Remote Code Execution Vulnerability in Bentley MicroStation CONNECT

CVE-2022-28302

Summary

This vulnerability affects installations of Bentley MicroStation CONNECT 10.16.02.34, allowing remote attackers to execute arbitrary code. Exploitation requires user interaction, as a user must visit a malicious webpage or open a specially crafted file. The flaw resides in the parsing of IFC files, where crafted data can cause a read past the end of an allocated buffer, enabling the execution of malicious code in the context of the current process.

References