High severity · published Feb 25, 2025
CVE-2025-1067
There is a code injection vulnerability in ArcGIS Pro
7.3
CVSS
0.2%
EPSS
No
On KEV
Description
There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific action using ArcGIS ArcGIS Pro, the file could execute and run malicious commands under the context of the victim. This issue is addressed in ArcGIS Pro 3.3.3 and 3.4.1.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
ArcGIS Pro · Esri
3.3.0 through 3.3.2; 3.4.0 · source: vendor, NVD
AA
Arcgis Allsource · Esri
1.2; 1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1067
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1067
Vendor Advisory
https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-pro-and-arcgis-allsource-patches-address-high-severity-vulnerabilities
More from ArcGIS Pro
7.8
CVE-2021-29098
Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and…
7.8
CVE-2021-29097
Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and…
7.8
CVE-2021-29096
A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allows…
7.3
CVE-2025-1068
There is a code injection vulnerability in Esri ArcGIS AllSource
5.0
CVE-2026-1446
XSS issue is Esri ArcGIS Pro versions 3.6.0 and earlier