CVE-2025-1067

There is a code injection vulnerability in ArcGIS Pro

Published Feb 25, 2025 CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Description

There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific action using ArcGIS ArcGIS Pro, the file could execute and run malicious commands under the context of the victim. This issue is addressed in ArcGIS Pro 3.3.3 and 3.4.1.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Esri

ArcGIS Pro

unaffected

Version	Status	Constraints
`3.3.0`	affected	≤ 3.3.2
`3.4.0`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:esri:arcgis_allsource:1.2:::::::*
	cpe:2.3:a:esri:arcgis_allsource:1.3:::::::*
	cpe:2.3:a:esri:arcgis_pro:3.3:::::::*
	cpe:2.3:a:esri:arcgis_pro:3.4:::::::*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-5364	There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific action using ArcGIS ArcGIS Pro, the file could execute and run malicious commands under the context of the victim. This issue is addressed in ArcGIS Pro 3.3.3 and 3.4.1.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.189% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-pro-and-arcgis-allsource-patches-address-high-severity-vulnerabilities

History

Jun 20, 2025 8:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs	cpe:2.3:a:esri:arcgis_allsource:1.2:-:::::: cpe:2.3:a:esri:arcgis_allsource:1.3:-:::::: cpe:2.3:a:esri:arcgis_pro:3.3:-:::::: cpe:2.3:a:esri:arcgis_pro:3.4:-::::::	cpe:2.3:a:esri:arcgis_allsource:1.2:::::::* cpe:2.3:a:esri:arcgis_allsource:1.3:::::::* cpe:2.3:a:esri:arcgis_pro:3.3:::::::* cpe:2.3:a:esri:arcgis_pro:3.4:::::::*

Mar 4, 2025 6:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Esri Esri arcgis Allsource Esri arcgis Pro
CPEs		cpe:2.3:a:esri:arcgis_allsource:1.2:-:::::: cpe:2.3:a:esri:arcgis_allsource:1.3:-:::::: cpe:2.3:a:esri:arcgis_pro:3.3:-:::::: cpe:2.3:a:esri:arcgis_pro:3.4:-::::::
Vendors & Products		Esri Esri arcgis Allsource Esri arcgis Pro

Feb 26, 2025 12:15 AM Description updated View changes

Type	Values Removed	Values Added
Description	There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific action using ArcGIS ArcGIS Pro, the file could execute and run malicious commands under the context of the victim.	There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific action using ArcGIS ArcGIS Pro, the file could execute and run malicious commands under the context of the victim. This issue is addressed in ArcGIS Pro 3.3.3 and 3.4.1.

Feb 26, 2025 12:00 AM Description updated View changes

Type	Values Removed	Values Added
Description	There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific action using ArcGIS ArcGIS Pro , the file could execute and run malicious commands under the context of the victim.	There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific action using ArcGIS ArcGIS Pro, the file could execute and run malicious commands under the context of the victim.

Feb 25, 2025 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Feb 25, 2025 4:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific action using ArcGIS ArcGIS Pro , the file could execute and run malicious commands under the context of the victim.
Title		There is a code injection vulnerability in ArcGIS Pro
Weaknesses		CWE-732
References		https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-pro-and-arcgis-allsource-patches-address-high-severity-vulnerabilities
Metrics		cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'}`