CVE-2022-43655: 
Bentley View vulnerability analysis and mitigation

CVE-2022-43655 is a heap-based buffer overflow vulnerability affecting Bentley View software. The vulnerability was discovered in the parsing of FBX files and was reported to the vendor on August 25, 2022. The issue stems from improper validation of user-supplied data length before copying it to a fixed-length heap-based buffer (ZDI Advisory).

The vulnerability has been assigned a CVSS v3.0 base score of 7.8 HIGH (Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The specific flaw exists within the parsing of FBX files, where the application fails to properly validate the length of user-supplied data before copying it to a fixed-length heap-based buffer. This vulnerability is tracked as ZDI-CAN-18491 (ZDI Advisory).

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code in the context of the current process on affected installations of Bentley View. The vulnerability requires user interaction, specifically that the target must visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability requires user interaction for successful exploitation. An attacker would need to convince a user to either visit a malicious webpage or open a specially crafted malicious file to trigger the vulnerability (ZDI Advisory).

The vulnerability has been fixed in Bentley View version 17.1. Users are advised to upgrade to this version or later to mitigate the risk (ZDI Advisory).