CVE-2021-29117: 
Esri ArcGIS ArcReader vulnerability analysis and mitigation

A use-after-free vulnerability (CVE-2021-29117) was discovered in Esri ArcReader 10.8.1 and earlier versions. The vulnerability allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user when parsing a specially crafted file (NVD).

The vulnerability is classified as CWE-416 (Use After Free) with a CVSS v3.1 base score of 7.8 (HIGH). The CVSS vector string is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The temporal score is 6.8, with unproven exploit code maturity (Vendor Advisory).

If successfully exploited, the vulnerability allows attackers to execute arbitrary code in the context of the current user, potentially leading to complete system compromise with the same privileges as the affected application (NVD, ZDI).

The vulnerability requires user interaction to exploit, specifically requiring the target to open a malicious file. The exploit code maturity is rated as 'Unproven' according to the temporal metrics (Vendor Advisory).

Esri has released ArcReader 10.8.2 to address this vulnerability. As this is the last release of ArcReader, users are encouraged to transition to updated alternatives for publishing and sharing map packages with ArcGIS Pro, and workflows using the ArcGIS Pro version of the ArcGIS Publisher extension in conjunction with ArcGIS Field Maps (Vendor Advisory).