CVE-2009-1862: Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability
Vulnerability summary
CVE-2009-1862 is a high (CVSS 9.3) Out-of-bounds Write vulnerability in Adobe Acrobat and Reader, Flash Player. It is known to be exploited: CISA lists it, first on 08-06-2022. EPSS estimates a 21.20% chance of exploitation in the next 30 days, higher than 97.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Duplicates 1Timeline
- 23-07-2009PublishedVulnerability first disclosed.
- 08-06-2022Added to CISA KEVAdobe Acrobat and Reader, Flash Player Unspecified Vulnerability
- 22-06-2022CISA remediation dueApply mitigations per vendor instructions.
- 22-10-2025Last modifiedVulnerability information updated.
Description
Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
21.20%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
-3.72 pp
From 24.92% on 21-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 08-06-2022
- Federal due date
- 22-06-2022
CISA required action
For Adobe Acrobat and Reader, apply updates per vendor instructions. For Adobe Flash Player, the impacted product is end-of-life and should be disconnected if still in use. nvd.nist.gov/vuln/detail/CVE-2009-1862
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Adobe3 products
- acrobat≥ 9.0, ≤ 9.1.2
- acrobat_reader≥ 9.0, ≤ 9.1.2
- flash_player≥ 9.0, ≤ 9.0.159.0 | ≥ 10.0, ≤ 10.0.22.87
1 vendor · 3 products
References
21 links- sunsolve.sun.com/search/document.do?assetkey=1-66-266108-1Vendor AdvisoryX Refsource SUNALERTBroken Link
- www.symantec.com/business/security_response/writeup.jsp?docid=2009-072209-2512-99X Refsource MISCBroken Link
- lists.apple.com/archives/security-announce/2009/Sep/msg00003.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
- blogs.adobe.com/psirt/2009/07/potential_adobe_reader_and_fla.htmlX Refsource MISCBroken LinkVendor Advisory
Show all 21 references
- lists.apple.com/archives/security-announce/2009/Sep/msg00004.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-1862Government ResourceUS Government Resource