CVE-2022-28312 in MicroStation CONNECT
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DS files. Crafted data in a 3DS file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-16342.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/17/2026
The vulnerability identified as CVE-2022-28312 represents a critical buffer over-read flaw within Bentley MicroStation CONNECT version 10.16.02.034, specifically affecting the parsing functionality of 3DS file formats. This issue falls under the CWE-125 weakness category, which describes out-of-bounds read conditions where a program accesses memory beyond the boundaries of a buffer. The vulnerability manifests when the software processes maliciously crafted 3DS files, which are commonly used for 3D graphics and modeling in engineering and architectural applications. The flaw occurs during the file parsing phase where insufficient input validation allows crafted data to trigger memory access violations.
The exploitation of this vulnerability requires user interaction, making it a client-side attack vector that relies on social engineering tactics to deliver malicious payloads. An attacker must convince a victim to open a specially crafted 3DS file, typically through phishing emails, malicious websites, or compromised software distributions. This user interaction requirement aligns with ATT&CK technique T1203, which covers exploitation of remote services through user interaction. The buffer over-read condition creates a predictable memory access pattern that can be leveraged to extract sensitive information from adjacent memory locations, potentially exposing system credentials, configuration data, or other confidential information stored in memory.
The operational impact of this vulnerability extends beyond simple information disclosure, as it provides a potential pathway for privilege escalation and arbitrary code execution. When the buffer over-read occurs during 3DS file parsing, it creates opportunities for attackers to manipulate memory contents or redirect execution flow within the targeted process. The vulnerability's classification as a remote code execution risk means that successful exploitation could allow attackers to gain full control over the affected system, particularly if the target application runs with elevated privileges. This represents a significant threat to engineering and construction organizations that rely heavily on Bentley MicroStation for critical infrastructure design and modeling work.
Mitigation strategies for CVE-2022-28312 should focus on both immediate defensive measures and long-term architectural improvements. Organizations should implement strict file validation controls and restrict the opening of 3DS files from untrusted sources, particularly in environments where the software runs with administrative privileges. The recommended approach includes applying the vendor-provided security patches and updates as soon as they become available, which typically address the underlying buffer over-read condition through improved input validation and memory boundary checks. Network-level protections such as web application firewalls and content filtering systems can help prevent the delivery of malicious 3DS files through email attachments or web downloads. Additionally, implementing principle of least privilege access controls and regular security assessments can reduce the potential impact of successful exploitation attempts. Organizations should also consider deploying endpoint detection and response solutions that can monitor for suspicious file processing activities and anomalous memory access patterns that may indicate exploitation attempts. The vulnerability demonstrates the importance of input validation in multimedia processing applications and highlights the need for robust memory safety practices in engineering software platforms that handle complex file formats.