Remote Code Execution Vulnerability in Bentley MicroStation

CVE-2022-28316

Summary

A vulnerability in Bentley MicroStation CONNECT enables remote attackers to execute arbitrary code. The flaw arises due to insufficient validation when parsing IFC files, allowing crafted data to cause a buffer overflow. This exploitation necessitates user interaction, as it requires the target to visit a malicious webpage or open a compromised file. Successful exploitation can result in the execution of code in the context of the current process, posing significant risks to the affected installations.

References