Code Execution Vulnerability in Bentley MicroStation CONNECT by Bentley

CVE-2022-28305

Summary

A vulnerability in Bentley MicroStation CONNECT allows remote attackers to execute arbitrary code through the improper handling of OBJ files. By enticing a user to visit a malicious webpage or open an infected file, an attacker can exploit the flaw stemming from inadequate validation of user-supplied data length. This oversight results in potential stack-based buffer overflow, permitting code execution within the context of the current process, enhancing the risk and impact of the attack.

References