PT-2025-7900 · Esri · Arcgis Pro

Published 2025-02-04 · Updated 2025-06-20 · CVE-2025-1067

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Esri ArcGIS Pro versions 3.3 through 3.4

Description The issue is related to an untrusted search path vulnerability that may allow a low-privileged attacker with write privileges to the local file system to introduce a malicious executable. When the victim performs a specific action using ArcGIS Pro, the malicious file could execute and run commands under the context of the victim.

Recommendations For Esri ArcGIS Pro versions 3.3 and 3.4, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Untrusted Search Path

Incorrect Permission

Weakness Enumeration

CWE-426

CWE-732

Related Identifiers

BDU:2025-02459

CVE-2025-1067

Affected Products

Arcgis Pro

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-1067 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1067 · Vendor Advisory
• https://esri.com/arcgis-blog/products/administration/administration/arcgis-pro-and-arcgis-allsource-patches-address-high-severity-vulnerabilities · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02459 · Security Note
• https://t.me/cvenotify/126318 · Telegram Post
• https://t.me/cvedetector/18889 · Telegram Post
• https://t.me/cvenotify/112518 · Telegram Post
• https://twitter.com/CVEnew/status/1894428579175227479 · Twitter Post