Remote Code Execution Vulnerability in Bentley MicroStation CONNECT

CVE-2022-28317

Summary

This vulnerability in Bentley MicroStation CONNECT allows remote attackers to execute arbitrary code by exploiting a flaw in the parsing of IFC files. The exploit requires user interaction, as the target must either visit a malicious webpage or open a compromised file. The underlying issue stems from improper memory initialization before access. Successful exploitation permits an attacker to run code in the context of the current process, posing a significant security risk for users.

References