CVE-2009-3459

Advisory lineage Upstream: 0 Downstream: 1
Downstream
RHSA-2009:1499
Undergoing Analysis
Published: 13 Oct 2009, 10:00
Last modified:20 May 2026, 17:16

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.3 HIGH
v2.0 (nvd)
EPSS Score
87.02% CRITICAL
87% probability -1.34%
KEV
Listed
CISA
1 listing
Ransomware
No reports
Public exploits
4 found
Dark Web
Not detected

Timeline

13 Oct 2009, 10:00
Published
Vulnerability first disclosed
20 May 2026, 00:00
Added to CISA KEV
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
20 May 2026, 17:16
Last Modified
Vulnerability information updated
03 Jun 2026, 00:00
CISA Remediation Due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.

CVSS Metrics

  • v3.1•HIGH•Score: 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 9.3AV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 87.02%• Percentile: 99%

Techniques & Countermeasures

  • CWE-119•Improper Restriction of Operations within the Bounds of a Memory Buffer

    The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

  • CWE-122•Heap-based Buffer Overflow

    A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Affected Systems

  • adobe•acrobat

    ≤ 9.1.3 | 3.0 | 3.1 | 4.0 | 4.0.5 | 4.0.5a | 4.0.5c | 5.0 | 5.0.5 | 5.0.6 | 5.0.10 | 6.0 | 6.0.1 | 6.0.2 | 6.0.3 | 6.0.4 | 6.0.5 | 7.0 | 7.0.1 | 7.0.2 | 7.0.3 | 7.0.4 | 7.0.5 | 7.0.6 | 7.0.7 | 7.0.8 | 7.0.9 | 7.1.3 | 8.0 | 8.1 | 8.1.1 | 8.1.2 | 8.1.3 | 8.1.4 | 8.1.6 | 9 | 9.0.0 | 9.1 | 9.1.1 | 9.1.2

  • adobe•acrobat_reader

    ≤ 9.0

  • adobe•reader

    3.0 | 4.0 | 4.0.5 | 4.0.5a | 4.0.5c | 4.5 | 5.0 | 5.0.5 | 5.0.6 | 5.0.7 | 5.0.9 | 5.0.10 | 5.0.11 | 5.1 | 6.0 | 6.0.1 | 6.0.2 | 6.0.3 | 6.0.4 | 6.0.5 | 7.0.1 | 7.0.2 | 7.0.3 | 7.0.5 | 7.0.7 | 7.0.8 | 7.0.9 | 7.1.0 | 7.1.1 | 7.1.3 | 8.1.1 | 8.1.2 | 8.1.4 | 8.1.6 | 9.0 | 9.1 | 9.1.2

References (13)