CVE-2025-1067
There is a code injection vulnerability in ArcGIS Pro
- State
- Published
- Severity
- 7.3 High
- Published
- Feb 25, 2025
- Updated
- Feb 26, 2025
- Reserved
- Feb 5, 2025
Description
There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific action using ArcGIS ArcGIS Pro, the file could execute and run malicious commands under the context of the victim. This issue is addressed in ArcGIS Pro 3.3.3 and 3.4.1.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.3 High | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H | Esri |
Weaknesses
- CWE-732 Incorrect Permission Assignment for Critical Resource
Affected Products
| Product | Versions |
|---|---|
ArcGIS ProEsri |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.