CVE-2021-29098

Published: Mar 25, 2021Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.

Affected (4)

Products: Esri: Arcgis Engine, Arcgis Pro, Arcmap, Arcreader

4 products

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Esri Arcgis Engine	Up to 10.8.1
Esri Arcgis Pro	Up to 2.7
Esri Arcmap	Up to 10.8.1
Esri Arcreader	Up to 10.8.1

Related CWEs

Access of Uninitialized Pointer

The product accesses or uses a pointer that has not been initialized.

References (8)

https://www.esri.com/arcgis-blog/products/arcgis/administration/security-advisory-general-raster/

Source: psirt@esri.com

Vendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-21-361/

Source: psirt@esri.com

Third Party AdvisoryVDB Entry

https://www.zerodayinitiative.com/advisories/ZDI-21-362/

Source: psirt@esri.com

Third Party AdvisoryVDB Entry

https://www.zerodayinitiative.com/advisories/ZDI-21-372/

Source: psirt@esri.com

Third Party AdvisoryVDB Entry

https://www.esri.com/arcgis-blog/products/arcgis/administration/security-advisory-general-raster/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-21-361/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://www.zerodayinitiative.com/advisories/ZDI-21-362/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://www.zerodayinitiative.com/advisories/ZDI-21-372/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.