CVE-2021-29098: 
Esri ArcGIS ArcReader vulnerability analysis and mitigation

Multiple uninitialized pointer vulnerabilities were discovered in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) when parsing specially crafted files. The vulnerability was disclosed on March 25, 2021, and was assigned CVE-2021-29098. This security flaw specifically affects the parsing of PMF files and allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user (MITRE CVE, ESRI Blog).

The vulnerability exists within the parsing of PMF files, where crafted data can trigger access to a pointer prior to initialization. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with a temporal score of 6.8. The exploit code maturity is rated as unproven, with official fixes available and the vulnerability confirmed by Esri (ZDI Advisory, ESRI Blog).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code on affected installations of Esri ArcReader and related products. The impact is significant as it affects the confidentiality, integrity, and availability of the system, with all three aspects rated as 'High' in the CVSS scoring (ZDI Advisory).

User interaction is required to exploit this vulnerability, specifically the target must visit a malicious page or open a malicious file. The vulnerability was initially reported to the vendor on November 24, 2020, and was publicly disclosed on March 30, 2021 (ZDI Advisory).

Esri has released updates for the affected products that resolve these high-risk vulnerabilities. For ArcGIS Pro, users should upgrade to version 2.7.1 or later. Official fixes are available for all affected products (ESRI Blog).