CVE-2021-29097CWE-121CWE-122

ArcGIS general raster security update: buffer overflow

High · published March 25, 2021

CVSS v3.0
7.8
EPSS
3%
Percentile
87.2
In the wild
Unconfirmed
What it is

Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02988 · 87.2th percentile
Weaknesses
CWE-121 · Stack-based Buffer Overflow; CWE-122 · Heap-based Buffer Overflow
Published
2021-03-25T20:36Z
EPSS history
Timeline
  • 25 MAR 20:36Z
    ArcGIS general raster security update: buffer overflow
    cvelistv5