CVE-2025-1067: Esri ArcGIS AllSource RCE Vulnerability

CVE-2025-1067 Overview

CVE-2025-1067 is an untrusted search path vulnerability affecting Esri ArcGIS Pro 3.3 and 3.4, along with ArcGIS AllSource 1.2 and 1.3. A low-privileged attacker with write access to the local file system can place a malicious executable in a location searched by the application. When a victim performs a specific action in ArcGIS Pro, the planted executable runs under the victim's security context. Esri addressed the flaw in ArcGIS Pro 3.3.3 and 3.4.1. The weakness is categorized under CWE-732: Incorrect Permission Assignment for Critical Resource.

Critical Impact
Successful exploitation allows arbitrary code execution under the victim's account, resulting in full compromise of confidentiality, integrity, and availability on the affected workstation.

Affected Products

Esri ArcGIS Pro 3.3
Esri ArcGIS Pro 3.4
Esri ArcGIS AllSource 1.2 and 1.3

Discovery Timeline

2025-02-25 - CVE-2025-1067 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1067

Vulnerability Analysis

The vulnerability stems from ArcGIS Pro and ArcGIS AllSource resolving executable or library paths in directories that are writable by low-privileged users. An attacker who can write to one of these locations can drop a malicious binary that the application will load or execute during normal operation. Because ArcGIS runs in the victim's session, the planted code inherits the victim's privileges and access to local files, network shares, and cached credentials.

Exploitation requires user interaction. The victim must perform a specific action inside ArcGIS Pro that triggers the search path lookup and executes the attacker-controlled file. The attack is local, so the adversary must already have some foothold or valid access to the target host.

Root Cause

The root cause is incorrect permission assignment on directories included in the application's search path. ArcGIS Pro trusts binaries found in these paths without validating their origin or integrity. This aligns with the CWE-732 classification, where a critical resource is assigned permissions that allow unintended actors to modify it.

Attack Vector

An attacker with a foothold on the workstation writes a malicious executable, such as a spoofed helper binary or DLL, into a directory that ArcGIS Pro searches during startup or feature invocation. The attacker then waits for or social-engineers the victim into launching the specific action that loads the file. The code executes without additional privilege prompts because it runs within the trusted ArcGIS process context.

No verified proof-of-concept has been published. Refer to the Esri Patch Advisory for ArcGIS for vendor-supplied technical details.

Detection Methods for CVE-2025-1067

Indicators of Compromise

Unexpected executables or DLLs written into ArcGIS Pro installation directories or user-writable subfolders under %LOCALAPPDATA% and %APPDATA% associated with ArcGIS.
Child processes spawned by ArcGISPro.exe that are not signed by Esri or that originate from user-writable locations.
File creation events for .exe or .dll files immediately preceding a launch of ArcGIS Pro by a standard user.

Detection Strategies

Monitor process creation events where the parent is ArcGISPro.exe and correlate against a baseline of expected child binaries.
Alert on module loads from non-standard directories into ArcGIS processes, particularly modules without valid Esri code-signing certificates.
Hunt for writes to ArcGIS-related directories by non-installer processes such as browsers, mail clients, or scripting hosts.

Monitoring Recommendations

Enable command-line and image-load logging on workstations running ArcGIS Pro, and forward the events to a central analytics platform.
Track version inventory for ArcGIS Pro and ArcGIS AllSource to identify hosts still running 3.3.x prior to 3.3.3 or 3.4 prior to 3.4.1.
Review directory ACLs on ArcGIS installation paths and flag any deviation that grants write access to non-administrative users.

How to Mitigate CVE-2025-1067

Immediate Actions Required

Upgrade ArcGIS Pro to version 3.3.3 or 3.4.1, and update ArcGIS AllSource to the fixed release identified in the vendor advisory.
Audit ACLs on ArcGIS installation directories and remove write permissions for standard users on any folder resolved during the application's search path.
Restrict local file system write access on GIS analyst workstations through least-privilege policies and application allowlisting.

Patch Information

Esri released fixed builds in ArcGIS Pro 3.3.3 and 3.4.1. Details are available in the Esri Patch Advisory for ArcGIS. Deploy the patches through the standard ArcGIS Pro update channel or via managed software distribution.

Workarounds

If patching is delayed, remove write permissions from all directories referenced in the ArcGIS Pro executable and library search paths.
Enforce Windows Defender Application Control or AppLocker rules that only permit execution of Esri-signed binaries within the ArcGIS process tree.
Isolate ArcGIS Pro workstations from shared user profiles and remove local administrator rights from GIS analyst accounts.

bash

# Configuration example: audit and restrict write access on ArcGIS install path
icacls "C:\Program Files\ArcGIS\Pro" /remove:g "Users"
icacls "C:\Program Files\ArcGIS\Pro" /grant:r "Administrators:(OI)(CI)F"
icacls "C:\Program Files\ArcGIS\Pro" /grant:r "Users:(OI)(CI)RX"