CVE-2022-28300 in MicroStation
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation 10.16.02.034 CONNECT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 images. Crafted data in a JP2 file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16202.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/17/2026
CVE-2022-28300 represents a critical buffer overflow vulnerability affecting Bentley MicroStation 10.16.02.034 CONNECT, a widely used computer-aided design software in engineering and construction sectors. This vulnerability resides within the JP2 image parsing functionality, specifically when processing crafted malicious JP2 files that contain malformed data structures. The flaw manifests as a write past the end of an allocated buffer, which occurs during the decompression and rendering of JP2 image formats. This type of vulnerability falls under CWE-121, which describes stack-based buffer overflow conditions where data is written beyond the bounds of a fixed-length buffer. The attack requires user interaction through visiting a malicious webpage or opening a malicious file, making it a client-side exploitation vector that aligns with ATT&CK technique T1203 for exploitation for execution.
The technical impact of this vulnerability extends beyond simple code execution, as it allows attackers to operate within the security context of the current process, potentially escalating privileges or accessing sensitive data. When a user opens a malicious JP2 file, the vulnerable parsing code fails to properly validate buffer boundaries during image processing, leading to memory corruption that can be exploited to overwrite adjacent memory locations. This creates opportunities for attackers to inject and execute arbitrary code with the same privileges as the MicroStation application, which typically runs with elevated permissions in engineering environments. The vulnerability's exploitation path demonstrates the classic characteristics of a buffer overflow attack where improper input validation leads to memory corruption and potential remote code execution.
From an operational standpoint, this vulnerability poses significant risks to organizations relying on Bentley MicroStation for critical infrastructure design and engineering work. The requirement for user interaction means that successful exploitation typically involves social engineering campaigns targeting engineering teams through phishing emails or compromised websites. Organizations using this software are particularly vulnerable because the attack vector does not require network-level access or advanced exploitation techniques, making it accessible to threat actors with moderate technical capabilities. The vulnerability's presence in a widely deployed design tool means that successful exploitation could compromise entire engineering workflows and potentially lead to the theft of intellectual property or manipulation of critical design data.
Mitigation strategies for CVE-2022-28300 should prioritize immediate software updates from Bentley Systems to address the buffer overflow in JP2 image parsing. Organizations should implement strict file validation policies that prevent automatic execution of potentially malicious files, including disabling automatic image preview in web browsers and email clients when dealing with design files. Network-level defenses should include content filtering systems that can detect and block suspicious JP2 file content, while endpoint protection solutions should be configured to monitor for unusual memory access patterns or process behavior that might indicate exploitation attempts. Security awareness training for engineering staff should emphasize the risks of opening untrusted design files and visiting suspicious websites, as these measures form the primary defense against the social engineering aspects of this vulnerability. Additionally, system administrators should consider implementing application whitelisting policies that restrict execution of unauthorized software and monitor for any unauthorized modifications to the MicroStation installation directory.