VYPR
← All advisories
High severity7.3NVD Advisory· Published Feb 25, 2025· Updated Jun 17, 2026

CVE-2025-1067

CVE-2025-1067

Description

There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific action using ArcGIS ArcGIS Pro, the file could execute and run malicious commands under the context of the victim. This issue is addressed in ArcGIS Pro 3.3.3 and 3.4.1.

Affected products

6
  • Esri/Arcgis Allsource2 versions
    cpe:2.3:a:esri:arcgis_allsource:1.2:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:esri:arcgis_allsource:1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:esri:arcgis_allsource:1.3:*:*:*:*:*:*:*
  • Esri/Arcgis Pro4 versions
    cpe:2.3:a:esri:arcgis_pro:3.3:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:esri:arcgis_pro:3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:esri:arcgis_pro:3.4:*:*:*:*:*:*:*
    • (no CPE)range: <3.3.3, <3.4.1
    • (no CPE)range: 3.3.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.