CVE-2009-3953: Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability

Vulnerability summary

CVE-2009-3953 is a high (CVSS 10.0) Out-of-bounds Write vulnerability in Adobe Acrobat and Reader. It is known to be exploited: CISA lists it, first on 08-06-2022. EPSS estimates a 83.22% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 13-01-2010
   PublishedVulnerability first disclosed.
2. 08-06-2022
   Added to CISA KEVAdobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability
3. 22-06-2022
   CISA remediation dueApply updates per vendor instructions.
4. 22-10-2025
   Last modifiedVulnerability information updated.

Description

The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.