ArcGIS general raster security update: buffer overflow
Priority LOW 39CWE-121Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.
Why it matters now
EPSS 0.02988 87th percentileScored 2026-11-07
Fix Fixed ArcReader (Esri): 10.9.0ArcGIS Desktop (Esri): 10.9.0+3 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Esri | ArcReader | All to before 10.9.0 | 10.9.0 | Patch available | CNA |
| Esri | ArcGIS Desktop | All to before 10.9.0 | 10.9.0 | Patch available | CNA |
| Esri | ArcGIS Engine | All to before 10.9.0 | 10.9.0 | Patch available | CNA |
| Esri | ArcGIS Engine | All to before 10.9.0 | 10.9.0 | Patch available | CNA |
| Esri | ArcGIS Pro | All to before 4.7.2 | 4.7.2 | Patch available | CNA |
| Esri | ArcGIS Desktop Background Geoprocessing | All to before 10.9 | 10.9 | Patch available | CNA |
| Esri | ArcGIS Desktop Background Geoprocessing | All to before 10.9 | 10.9 | Patch available | CNA |
- ArcReader VendorEsri Affected All to before 10.9.0 Fixed in 10.9.0 Patch available CNA
- ArcGIS Desktop VendorEsri Affected All to before 10.9.0 Fixed in 10.9.0 Patch available CNA
- ArcGIS Engine VendorEsri Affected All to before 10.9.0 Fixed in 10.9.0 Patch available CNA
- ArcGIS Engine VendorEsri Affected All to before 10.9.0 Fixed in 10.9.0 Patch available CNA
- ArcGIS Pro VendorEsri Affected All to before 4.7.2 Fixed in 4.7.2 Patch available CNA
- ArcGIS Desktop Background Geoprocessing VendorEsri Affected All to before 10.9 Fixed in 10.9 Patch available CNA
- ArcGIS Desktop Background Geoprocessing VendorEsri Affected All to before 10.9 Fixed in 10.9 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:esri:arcgis_engine:*:*:*:*:*:*:*:* | up to 10.8.1 | Vulnerable | Esri |
| cpe:2.3:a:esri:arcgis_pro:*:*:*:*:*:*:*:* | up to 2.7 | Vulnerable | Esri |
| cpe:2.3:a:esri:arcmap:*:*:*:*:*:*:*:* | up to 10.8.1 | Vulnerable | Esri |
| cpe:2.3:a:esri:arcreader:*:*:*:*:*:*:*:* | up to 10.8.1 | Vulnerable | Esri |
- cpe:2.3:a:esri:arcgis_engine:*:*:*:*:*:*:*:* Versions up to 10.8.1 Vulnerable ·Esri
- cpe:2.3:a:esri:arcgis_pro:*:*:*:*:*:*:*:* Versions up to 2.7 Vulnerable ·Esri
- cpe:2.3:a:esri:arcmap:*:*:*:*:*:*:*:* Versions up to 10.8.1 Vulnerable ·Esri
- cpe:2.3:a:esri:arcreader:*:*:*:*:*:*:*:* Versions up to 10.8.1 Vulnerable ·Esri
Remediation
- Fix · CNA ArcReader (Esri) Fixed in 10.9.0
- Fix · CNA ArcGIS Desktop (Esri) Fixed in 10.9.0
- Fix · CNA ArcGIS Engine (Esri) Fixed in 10.9.0
- Fix · CNA ArcGIS Engine (Esri) Fixed in 10.9.0
- Fix · CNA ArcGIS Pro (Esri) Fixed in 4.7.2
- Fix · CNA ArcGIS Desktop Background Geoprocessing (Esri) Fixed in 10.9
- Fix · CNA ArcGIS Desktop Background Geoprocessing (Esri) Fixed in 10.9
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Esri ArcGIS Desktop, ArcGIS Engine, ArcReader 10.9.0
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2021-09985 ArcGIS general raster security update: uninitialized pointerPriority MEDIUM 40
- TI-2021-09983 ArcGIS general raster security update: use-after-freePriority LOW 37
- Release ·
Esri ArcGIS Pro 4.7.2
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2021-09985 ArcGIS general raster security update: uninitialized pointerPriority MEDIUM 40
Timeline
- 2026-10-02 Threatist record created from CVE-2021-29097
- 2026-10-03 Alias added: GHSA-wr7p-7f4r-37fr
References
Advisory 9
- https://www.esri.com/arcgis-blog/products/arcgis/administration/security-advisory-general-raster/
- https://www.zerodayinitiative.com/advisories/ZDI-21-367/
- https://www.zerodayinitiative.com/advisories/ZDI-21-371/
- https://www.zerodayinitiative.com/advisories/ZDI-21-364/
- https://www.zerodayinitiative.com/advisories/ZDI-21-363/
- https://www.zerodayinitiative.com/advisories/ZDI-21-369/
- https://www.zerodayinitiative.com/advisories/ZDI-21-368/
- https://www.zerodayinitiative.com/advisories/ZDI-21-365/
- https://www.zerodayinitiative.com/advisories/ZDI-21-360/
More Esri Arcgis Engine vulnerabilities
- TI-2021-09985 ArcGIS general raster security update: uninitialized pointer CVSS 3.1HIGH 7.8
- TI-2021-09983 ArcGIS general raster security update: use-after-free CVSS 3.1HIGH 7.8
Sources
- CVE-2021-29097 · CVE Program
- CVE-2021-29097 · NVD
- FIRST EPSS
- GHSA-wr7p-7f4r-37fr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences