ArcGIS general raster security update: uninitialized pointer
Priority MEDIUM 40CWE-824Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-824 and the CVSS impact.
Summary
Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02021 81st percentileScored 2026-11-07
Fix Fixed ArcReader (Esri): 10.9.0ArcGIS Desktop (Esri): 10.9.0+3 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Esri | ArcReader | All to before 10.9.0 | 10.9.0 | Patch available | CNA |
| Esri | ArcGIS Desktop | All to before 10.9.0 | 10.9.0 | Patch available | CNA |
| Esri | ArcGIS Engine | All to before 10.9.0 | 10.9.0 | Patch available | CNA |
| Esri | ArcGIS Engine | All to before 10.9.0 | 10.9.0 | Patch available | CNA |
| Esri | ArcGIS Engine | All to before 10.9.0 | 10.9.0 | Patch available | CNA |
| Esri | ArcGIS Engine | All to before 10.9.0 | 10.9.0 | Patch available | CNA |
| Esri | ArcGIS Pro | All to before 4.7.2 | 4.7.2 | Patch available | CNA |
| Esri | ArcGIS Desktop Background Geoprocessing | All to before 10.9.0 | 10.9.0 | Patch available | CNA |
| Esri | ArcGIS Desktop Background Geoprocessing | All to before 10.9.0 | 10.9.0 | Patch available | CNA |
- ArcReader VendorEsri Affected All to before 10.9.0 Fixed in 10.9.0 Patch available CNA
- ArcGIS Desktop VendorEsri Affected All to before 10.9.0 Fixed in 10.9.0 Patch available CNA
- ArcGIS Engine VendorEsri Affected All to before 10.9.0 Fixed in 10.9.0 Patch available CNA
- ArcGIS Engine VendorEsri Affected All to before 10.9.0 Fixed in 10.9.0 Patch available CNA
- ArcGIS Engine VendorEsri Affected All to before 10.9.0 Fixed in 10.9.0 Patch available CNA
- ArcGIS Engine VendorEsri Affected All to before 10.9.0 Fixed in 10.9.0 Patch available CNA
- ArcGIS Pro VendorEsri Affected All to before 4.7.2 Fixed in 4.7.2 Patch available CNA
- ArcGIS Desktop Background Geoprocessing VendorEsri Affected All to before 10.9.0 Fixed in 10.9.0 Patch available CNA
- ArcGIS Desktop Background Geoprocessing VendorEsri Affected All to before 10.9.0 Fixed in 10.9.0 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:esri:arcgis_engine:*:*:*:*:*:*:*:* | up to 10.8.1 | Vulnerable | Esri |
| cpe:2.3:a:esri:arcgis_pro:*:*:*:*:*:*:*:* | up to 2.7 | Vulnerable | Esri |
| cpe:2.3:a:esri:arcmap:*:*:*:*:*:*:*:* | up to 10.8.1 | Vulnerable | Esri |
| cpe:2.3:a:esri:arcreader:*:*:*:*:*:*:*:* | up to 10.8.1 | Vulnerable | Esri |
- cpe:2.3:a:esri:arcgis_engine:*:*:*:*:*:*:*:* Versions up to 10.8.1 Vulnerable ·Esri
- cpe:2.3:a:esri:arcgis_pro:*:*:*:*:*:*:*:* Versions up to 2.7 Vulnerable ·Esri
- cpe:2.3:a:esri:arcmap:*:*:*:*:*:*:*:* Versions up to 10.8.1 Vulnerable ·Esri
- cpe:2.3:a:esri:arcreader:*:*:*:*:*:*:*:* Versions up to 10.8.1 Vulnerable ·Esri
Remediation
- Fix · CNA ArcReader (Esri) Fixed in 10.9.0
- Fix · CNA ArcGIS Desktop (Esri) Fixed in 10.9.0
- Fix · CNA ArcGIS Engine (Esri) Fixed in 10.9.0
- Fix · CNA ArcGIS Engine (Esri) Fixed in 10.9.0
- Fix · CNA ArcGIS Engine (Esri) Fixed in 10.9.0
- Fix · CNA ArcGIS Engine (Esri) Fixed in 10.9.0
- Fix · CNA ArcGIS Pro (Esri) Fixed in 4.7.2
- Fix · CNA ArcGIS Desktop Background Geoprocessing (Esri) Fixed in 10.9.0
- Fix · CNA ArcGIS Desktop Background Geoprocessing (Esri) Fixed in 10.9.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Esri ArcGIS Desktop, ArcGIS Engine, ArcReader 10.9.0
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2021-09984 ArcGIS general raster security update: buffer overflowPriority LOW 39
- TI-2021-09983 ArcGIS general raster security update: use-after-freePriority LOW 37
- Release ·
Esri ArcGIS Pro 4.7.2
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2021-09984 ArcGIS general raster security update: buffer overflowPriority LOW 39
Show 1 more group
- Release ·
Esri ArcGIS Desktop Background Geoprocessing 10.9.0
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2021-09983 ArcGIS general raster security update: use-after-freePriority LOW 37
Timeline
- 2026-10-02 Threatist record created from CVE-2021-29098
- 2026-10-03 Alias added: GHSA-5gqj-6vcf-6f45
References
More Esri Arcgis Engine vulnerabilities
- TI-2021-09984 ArcGIS general raster security update: buffer overflow CVSS 3.1HIGH 7.8
- TI-2021-09983 ArcGIS general raster security update: use-after-free CVSS 3.1HIGH 7.8
Sources
- CVE-2021-29098 · CVE Program
- CVE-2021-29098 · NVD
- FIRST EPSS
- GHSA-5gqj-6vcf-6f45 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences