CVE-2022-28313 in MicroStation CONNECT
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DS files. Crafted data in a 3DS file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-16343.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/18/2026
The vulnerability identified as CVE-2022-28313 represents a critical buffer overread flaw within Bentley MicroStation CONNECT version 10.16.02.034, a widely used computer-aided design software platform. This vulnerability specifically manifests during the parsing of 3DS files, which are three-dimensional graphics file formats commonly used for exchanging 3D models between different software applications. The flaw stems from inadequate input validation and memory management within the software's file parsing engine, creating a scenario where maliciously crafted 3DS files can trigger unintended memory access patterns.
The technical implementation of this vulnerability falls under CWE-125, which describes "Out-of-bounds Read" conditions where a program reads data past the end of a valid buffer. When a malicious 3DS file is processed by MicroStation, the parsing routine fails to properly validate the boundaries of allocated memory buffers, allowing an attacker to craft specific data sequences that cause the application to read beyond the intended buffer limits. This read past the end of a buffer creates a potential information disclosure scenario where adjacent memory contents may be exposed to the attacker.
The operational impact of this vulnerability extends beyond simple information disclosure, as it creates a foundation for more sophisticated attacks within the ATT&CK framework's initial access and execution phases. The vulnerability requires user interaction to be exploited, meaning a target must visit a malicious webpage or open a malicious file containing the crafted 3DS content. This user interaction requirement places the vulnerability in the context of social engineering campaigns and phishing attacks, where attackers might disguise malicious 3DS files within seemingly legitimate design documents or project files. The exploitation chain can potentially lead to arbitrary code execution in the context of the current process, making this a significant threat to system security.
From a security perspective, this vulnerability demonstrates the critical importance of proper memory management and input validation in software applications handling file formats. The fact that this vulnerability was tracked as ZDI-CAN-16343 indicates it was identified through coordinated vulnerability disclosure channels, highlighting the need for continuous security testing and vulnerability management programs. Organizations using Bentley MicroStation should consider implementing network segmentation to limit exposure, deploying web application firewalls to filter malicious content, and ensuring timely patch deployment to address this and similar vulnerabilities. The vulnerability also underscores the necessity of user awareness training to recognize potentially malicious file attachments and the importance of maintaining up-to-date security patches across all software components.