CVE-2025-1068: Esri ArcGIS AllSource RCE Vulnerability

CVE-2025-1068 Overview

CVE-2025-1068 is an untrusted search path vulnerability affecting Esri ArcGIS AllSource versions 1.2 and 1.3. A low-privileged attacker with write access to the local file system can place a malicious executable in a location searched by the application. When a victim performs a specific action in ArcGIS AllSource, the planted binary executes under the victim's user context. The flaw is tracked under CWE-426: Untrusted Search Path and is corrected in ArcGIS AllSource 1.2.1 and 1.3.1. Related patches were also issued for ArcGIS Pro 3.3 and 3.4.

Critical Impact
Successful exploitation yields code execution under the victim's account, compromising confidentiality, integrity, and availability of the workstation and associated GIS data.

Affected Products

Esri ArcGIS AllSource 1.2
Esri ArcGIS AllSource 1.3
Esri ArcGIS Pro 3.3 and 3.4

Discovery Timeline

2025-02-25 - CVE-2025-1068 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1068

Vulnerability Analysis

The vulnerability originates from ArcGIS AllSource resolving executable or library dependencies through an insecure search path. When the application initiates a specific action, it searches directories the user can write to before reaching the trusted install location. An attacker who has already obtained low-privileged access to the target machine can drop a malicious binary matching the expected filename. The application loads or executes the attacker-controlled file, granting code execution in the victim's session.

Because the exploit runs in the victim's context, the attacker inherits access to local files, network shares, saved credentials, and any GIS project data the user can reach. The bug is local and requires user interaction, but it is well-suited to post-compromise lateral movement and persistence on shared analyst workstations.

Root Cause

The root cause is improper control of the resource search path (CWE-426). ArcGIS AllSource does not fully qualify the path to a required executable or module, and it does not restrict search order to trusted, non-user-writable directories. Windows resolves the reference against the current working directory or another writable location before the intended install path, enabling binary planting.

Attack Vector

Exploitation requires local access and low privileges on the target host. The attacker writes a malicious executable to a directory in the application's search path. The victim then triggers the vulnerable workflow in ArcGIS AllSource, at which point the planted file runs. No verified proof-of-concept exploit is public, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Esri patch announcement for vendor guidance.

No verified exploit code is available for this vulnerability. Refer to the vendor advisory for technical details.

Detection Methods for CVE-2025-1068

Indicators of Compromise

Unexpected executables or DLLs in user-writable directories that share names with legitimate ArcGIS AllSource binaries or dependencies.
Process creation events where ArcGISAllSource.exe or related child processes launch binaries from user profile paths such as C:\Users\<user>\.
Newly written files with executable extensions in the ArcGIS working directory shortly before the application is launched.

Detection Strategies

Hunt for process ancestry showing ArcGIS AllSource spawning unsigned or unusually located executables.
Alert on file writes of .exe, .dll, or .bat artifacts to directories that fall within the application's runtime search path.
Compare loaded module paths for ArcGIS processes against a known-good baseline of the installation directory.

Monitoring Recommendations

Enable Windows Sysmon Event IDs 1 (process create) and 11 (file create) on hosts running ArcGIS AllSource or ArcGIS Pro.
Forward endpoint telemetry to a centralized data lake or SIEM to correlate binary drops with subsequent ArcGIS process launches.
Track version inventory of ArcGIS AllSource and ArcGIS Pro to confirm patched builds are deployed across the environment.

How to Mitigate CVE-2025-1068

Immediate Actions Required

Upgrade ArcGIS AllSource 1.2 to version 1.2.1 and ArcGIS AllSource 1.3 to version 1.3.1.
Apply the corresponding ArcGIS Pro 3.3 and 3.4 security patches referenced in the vendor advisory.
Audit workstations for unauthorized executables in ArcGIS working directories and user-writable paths.

Patch Information

Esri has released fixed builds in ArcGIS AllSource 1.2.1 and 1.3.1, along with patches for ArcGIS Pro. Details and downloads are available in the Esri ArcGIS Pro and ArcGIS AllSource patch announcement.

Workarounds

Restrict write permissions on directories that fall within the ArcGIS AllSource search path so only administrators can modify them.
Enforce application allowlisting (for example, Windows Defender Application Control or AppLocker) to block execution of unsigned binaries from user profile locations.
Limit local write access on shared analyst workstations by removing unnecessary administrative or power-user rights.

bash

# Example AppLocker rule to block unsigned executables from user profile paths
New-AppLockerPolicy -RuleType Path -User Everyone -Action Deny \
  -Path "%OSDRIVE%\Users\*\*.exe" -RuleNamePrefix "BlockUserWritableExec"