CVE-2021-46656

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15631.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Feb 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-466575.5get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY.CVE-2021-466585.5save_window_function_values in MariaDB before 10.6.3 allows an application crash because of incorrect handling of with_window_func=true for CVE-2021-466595.5MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECT_LEX::nest_level is local to each VIEW.CVE-2021-466609.8Signiant Manager+Agents before 15.1 allows XML External Entity (XXE) attacks.CVE-2021-466615.5MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE CVE-2021-466625.5MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction with a nested subquery.CVE-2021-466635.5MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements.CVE-2021-466645.5MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr.CVE-2021-466655.5MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations.CVE-2021-466665.5MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE clause.CVE-2021-466675.5MariaDB before 10.6.5 has a sql_lex.cc integer overflow, leading to an application crash.CVE-2021-466685.5MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine