What’s Vulnerable › Vulnerabilities

CVE-2021-29118: Esri ArcReader PMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-12 · updated 2026-06-17
• Weakness: CWE-125

Description

An out-of-bounds read vulnerability exists when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) which allow an unauthenticated attacker to induce an information disclosure issue in the context of the current user.

Affected products

• Esri ArcReader: through 10.8.1

References

• https://www.esri.com/arcgis-blog/products/arcgis-desktop/administration/arcreader-general-data-frame-security-update/
• https://www.esri.com/arcgis-blog/products/arcgis-desktop/administration/arcreader-general-data-frame-security-update/

Get alerted when CVE-2021-29118 or the next vulnerability affects your stack