CVE-2021-29096: high-severity vulnerability in Esri ArcReader
ArcGIS general raster security update: use-after-free
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A memory flaw in ArcGIS applications allows an attacker to run malicious code on your computer by sending a specially crafted file. Once you open the file, the attacker gains the same access and permissions as you.
Use-after-free vulnerability in raster file parsing across ArcReader, ArcGIS Desktop, ArcGIS Engine ≤10.8.1, and ArcGIS Pro ≤2.7. Unauthenticated remote code execution is achieved through a maliciously crafted file that triggers access to freed memory, enabling arbitrary code execution within the current user's context.
In the same product, most dangerous first.