Arbitrary Code Execution Vulnerability in Bentley MicroStation by Bentley

CVE-2022-28641

Summary

This vulnerability in Bentley MicroStation CONNECT 10.16.02.34 allows remote attackers to execute arbitrary code by manipulating IFC files. Exploitation requires user interaction, such as visiting a malicious webpage or opening a compromised file. The vulnerability arises from insufficient validation of object existence during IFC file parsing, enabling attackers to run code in the application's process context.

References