title: ArcGIS Server image service and raster analytics security update: uninitialized pointer
description: Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.
problem types: CWE-824 Access of Uninitialized Pointer
affected:
{
platforms: x64
product: ArcGIS Server
vendor: Esri
versions:
lessThan: 10.9, status: affected, version: 10.8.1, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.0
]