CVE-2021-34915

Vulnerability

The vulnerability exists in Bentley View version 10.15.0.75 and prior versions (before 10.16.02.*) during the parsing of J2K files. A crafted J2K file can trigger a write past the end of an allocated buffer, leading to memory corruption. User interaction is required: the target must open the malicious file or visit a page that triggers the parsing [1][2].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious J2K file and convincing a user to open it (e.g., via email or a malicious webpage). No authentication or special privileges are needed. The out-of-bounds write occurs during parsing, allowing the attacker to overwrite memory and control execution flow [1].

Impact

Successful exploitation enables arbitrary code execution in the context of the current process. This can lead to full compromise of confidentiality, integrity, and availability of the affected system, with the attacker gaining the same privileges as the user running Bentley View [1][2].

Mitigation

Bentley has released mitigated versions: Bentley View 10.16.02.* and later. Users should update to the latest version. As a workaround, only open J2K files from trusted sources until the update is applied [2].