Remote Code Execution Vulnerability in Bentley MicroStation CONNECT

CVE-2022-28304

Summary

A remote code execution vulnerability exists in Bentley MicroStation CONNECT due to improper validation of user-supplied data when parsing OBJ files. An attacker could exploit this by enticing a user to visit a malicious web page or open a compromised file, leading to arbitrary code execution within the context of the affected application. The issue arises from insufficient checks on the length of data copied to a fixed-length buffer, highlighting the importance of robust input validation in software security.

References