CVE-2022-28320 in View
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.16.02.022. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DM files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16282.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/18/2026
CVE-2022-28320 represents a critical remote code execution vulnerability affecting Bentley View version 10.16.02.022, demonstrating a classic memory safety issue that falls under CWE-457. This vulnerability resides in the software's 3DM file parsing functionality, where insufficient memory initialization creates a dangerous condition that attackers can exploit through crafted malicious files. The flaw specifically manifests as improper memory handling during file processing, creating a pathway for arbitrary code execution within the application's security context. The vulnerability requires user interaction to be exploited, meaning victims must either visit a malicious webpage or open a specially crafted 3DM file, making it particularly concerning for environments where users frequently handle external documents.
The technical exploitation of this vulnerability leverages a memory initialization flaw that allows attackers to manipulate the application's memory state before it has been properly set up for access. This type of vulnerability typically occurs when the software attempts to read from or write to memory locations that have not been adequately initialized, creating opportunities for memory corruption that can be exploited to redirect execution flow. The attack surface is specifically tied to the 3DM file format parsing component, which suggests that the vulnerability may be part of a broader class of issues affecting file format parsers in desktop applications. This aligns with ATT&CK technique T1203, which covers exploitation of software vulnerabilities through file format parsing, and represents a common vector for privilege escalation attacks.
The operational impact of CVE-2022-28320 extends beyond simple code execution, as the vulnerability allows full control of the affected system within the application's security boundaries. Attackers can leverage this to perform actions such as installing malware, modifying system files, or accessing sensitive data, all while operating under the privileges of the Bentley View process. The requirement for user interaction makes this vulnerability particularly dangerous in social engineering scenarios, where attackers might craft convincing phishing campaigns or malicious websites designed to trigger the exploit. Organizations using Bentley View for engineering and construction documentation are especially at risk, as these applications often handle sensitive project data and may be used in environments with high security requirements.
Mitigation strategies for CVE-2022-28320 should focus on immediate patching and operational controls. The primary recommendation involves applying the vendor-provided security update that addresses the memory initialization flaw in the 3DM file parser. Until patches are deployed, organizations should implement strict file handling policies that prevent users from opening untrusted 3DM files, particularly from external sources or unknown origins. Network-based protections such as web application firewalls and content filtering systems can help detect and block malicious 3DM files before they reach end users. Additionally, user education and awareness programs should emphasize the dangers of opening suspicious files and visiting untrusted websites, as these remain the primary attack vectors for this vulnerability. Security monitoring should include detection of unusual file processing activities and potential exploitation attempts within Bentley View applications, implementing both signature-based and anomaly-based detection methods to identify potential compromise attempts.