Untrusted Search Path Vulnerability in Esri ArcGIS Pro Software

CVE-2025-1067

What is CVE-2025-1067?

An untrusted search path vulnerability exists in Esri's ArcGIS Pro versions 3.3 and 3.4. This flaw enables a low privileged attacker, who has write access to the local file system, to place a malicious executable file into the system. When the user of ArcGIS Pro inadvertently triggers a specific action, the system can execute the malicious file, which may lead to unauthorized commands being run under the victim’s context, compromising user security and system integrity.

References