Arbitrary Code Execution Vulnerability in Bentley MicroStation CONNECT by Bentley Systems

CVE-2022-28311

Summary

This vulnerability enables remote attackers to execute arbitrary code on installations of Bentley MicroStation CONNECT version 10.16.02.034. The issue arises during the parsing of DXF files, where crafted data can lead to a read past the end of an allocated buffer. Exploitation requires user interaction, as the target must either visit a malicious webpage or open a compromised file. By leveraging this vulnerability, an attacker can execute code within the context of the affected process, posing significant security risks.

References