CVE-2021-46632: 
Bentley MicroStation CONNECT vulnerability analysis and mitigation

CVE-2021-46632 is a vulnerability in Bentley View 10.15.0.75 that allows remote attackers to disclose sensitive information. The vulnerability was discovered by Mat Powell of Trend Micro Zero Day Initiative and was disclosed on January 31st, 2022. The vulnerability affects Bentley View versions prior to 10.16.02.* (Bentley Advisory, ZDI Advisory).

The vulnerability exists within the parsing of JP2 images. The specific flaw results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.1 base score of 3.3 (Low) with the vector: AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. The weakness has been classified as CWE-125 (Out-of-bounds Read) (ZDI Advisory).

The vulnerability allows attackers to disclose sensitive information on affected installations of Bentley View. An attacker can leverage this vulnerability in conjunction with other vulnerabilities to potentially execute arbitrary code in the context of the current process (ZDI Advisory).

Bentley has released version 10.16.02.* to address this vulnerability. Users are recommended to update to the latest version of the software. As a general best practice, it is also recommended to only open JP2 files coming from trusted sources (Bentley Advisory).