CVE-2021-29097highCWE-121CWE-122

CVE-2021-29097: high-severity vulnerability in Esri ArcReader

ArcGIS general raster security update: buffer overflow

Published · Updated

Follow this CVE+ Monitor ArcReader+ Monitor ArcGIS Pro

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.8epss 3.0%
In short

ArcGIS and ArcReader contain buffer overflow flaws when processing specially crafted raster files. An attacker can send a malicious file to execute arbitrary code on the victim's computer.

Technical detail

Multiple stack and heap buffer overflows exist in raster file parsing across ArcGIS Desktop, ArcGIS Engine 10.8.1 and earlier, ArcGIS Pro 2.7 and earlier, and ArcReader. An unauthenticated attacker can exploit these by providing a specially crafted file, leading to arbitrary code execution with user privileges; no authentication or user interaction restrictions are specified beyond file opening.

Summary generated and translated by AI from the official description.
Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Esri · ArcGIS DesktopEsri · ArcGIS Desktop Background GeoprocessingEsri · ArcGIS EngineEsri · ArcGIS ProEsri · ArcReader
Related CVEs — Esri ArcReader

In the same product, most dangerous first.

CVE-2021-29098HIGHArcGIS general raster security update: uninitialized pointerEPSS 2.0%CVE-2021-29096HIGHArcGIS general raster security update: use-after-freeEPSS 1.6%