Medium severity · published Mar 25, 2021
CVE-2021-29094
Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized…
6.8
CVSS
1%
EPSS
No
On KEV
Description
Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Arcgis Server · Esri
through 10.8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-29094
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-29094
Vendor Advisory
https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/security-advisory-server-image
More from Arcgis Server
10.0
CVE-2025-57870
A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes
9.8
CVE-2026-10757
BUG-000187511 - ArcGIS Server has a security vulnerability.
9.8
CVE-2026-9182
Unvalidated File Upload vulnerability in ArcGIS Server.
9.8
CVE-2021-29114
A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity…
9.8
CVE-2020-35712
Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations