CVE-2021-29097: 
Esri ArcGIS ArcReader vulnerability analysis and mitigation

CVE-2021-29097 is a buffer overflow vulnerability affecting multiple Esri products including ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier), and ArcGIS Pro 2.7 (and earlier). The vulnerability was discovered in late 2020 and publicly disclosed on March 16, 2021. This security flaw allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user when parsing specially crafted files (Esri Blog, CVE Mitre).

The vulnerability stems from multiple buffer overflow issues, including both stack-based and heap-based buffer overflows, specifically when parsing PMF files. The core issue results from the lack of proper validation of user-supplied data length before copying it to fixed-length buffers. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with a temporal score of 6.8, indicating its high severity (ZDI Advisory, Esri Blog).

If successfully exploited, this vulnerability allows remote attackers to execute arbitrary code on affected installations of Esri products. The execution occurs in the context of the current process, potentially giving attackers significant control over the affected system. User interaction is required for exploitation, as the target must visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability requires user interaction for exploitation, specifically opening a malicious file or visiting a malicious page. The exploit code maturity is rated as 'Unproven' according to the temporal metrics, suggesting that no known exploits were available at the time of disclosure (Esri Blog).

Esri has released official updates to address this vulnerability. For ArcGIS Pro users, the recommendation is to upgrade to version 2.7.1 or later. Updates have also been provided for other affected products including ArcReader, ArcGIS Desktop, and ArcGIS Engine (Esri Blog).