CVE-2021-29094mediumCWE-120

CVE-2021-29094: medium-severity vulnerability in Esri ArcGIS Server

ArcGIS Server image service and raster analytics security update: buffer overflow

Published · Updated

Follow this CVE+ Monitor ArcGIS Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.4epss 1.0%
In short

A buffer overflow vulnerability in ArcGIS Server allows an authenticated attacker with special permissions to crash the service or run malicious code by uploading a specially crafted file.

Technical detail

Multiple buffer overflow vulnerabilities exist in ArcGIS Server 10.8.1 and earlier when parsing specially crafted files in image services and raster analytics. An authenticated attacker with specialized permissions can trigger memory corruption leading to arbitrary code execution within the service account context.

Summary generated and translated by AI from the official description.
Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected products
Esri · ArcGIS Server
Related CVEs — Esri ArcGIS Server

In the same product, most dangerous first.

CVE-2021-29115MEDIUMAn information disclosure vulnerabilityEPSS 2.2%CVE-2021-29102CRITICALThere is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below.EPSS 1.6%CVE-2022-38202HIGHBUG-000152121 - Directory traversal vulnerability in ArcGIS Server.EPSS 1.4%CVE-2026-9181CRITICALDirectory Traversal in ArcGIS ServerEPSS 1.2%CVE-2022-38196MEDIUMBUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerabilityEPSS 1.2%CVE-2021-29114HIGHSQL injection vulnerability in ArcGIS ServerEPSS 1.0%