CVE-2021-29098CWE-824

ArcGIS general raster security update: uninitialized pointer

High · published March 25, 2021

CVSS v3.0
7.8
EPSS
2%
Percentile
80.8
In the wild
Unconfirmed
What it is

Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02021 · 80.8th percentile
Weakness
CWE-824 · Access of Uninitialized Pointer
Published
2021-03-25T20:37Z
EPSS history
Timeline
  • 25 MAR 20:37Z
    ArcGIS general raster security update: uninitialized pointer
    cvelistv5