VYPR
← All advisories
High severity7.8NVD Advisory· Published Mar 25, 2021· Updated Jun 17, 2026

CVE-2021-29096

CVE-2021-29096

Description

A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

13
  • Esri/Arcgis Engine
    cpe:2.3:a:esri:arcgis_engine:*:*:*:*:*:*:*:*
    Range: <=10.8.1
  • Esri/Arcgis Pro2 versions
    cpe:2.3:a:esri:arcgis_pro:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:esri:arcgis_pro:*:*:*:*:*:*:*:*range: <=2.7
    • (no CPE)range: <=2.7
  • Esri/Arcmap
    cpe:2.3:a:esri:arcmap:*:*:*:*:*:*:*:*
    Range: <=10.8.1
  • Esri/ArcReader3 versions
    cpe:2.3:a:esri:arcreader:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:esri:arcreader:*:*:*:*:*:*:*:*range: <=10.8.1
    • (no CPE)range: <=10.8.1
    • (no CPE)range: All
  • Esri/Arcgis For Desktopllm-fuzzy2 versions
    <=10.8.1+ 1 more
    • (no CPE)range: <=10.8.1
    • (no CPE)range: All
  • Esri/Arcgis For Enginellm-fuzzy2 versions
    <=10.8.1+ 1 more
    • (no CPE)range: <=10.8.1
    • (no CPE)range: All
  • Esri/ArcGIS Desktop Background Geoprocessingv5
    Range: All
  • Esri/ArcGIS Engine Background Geoprocessingv5
    Range: All

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.