{"schemaVersion":3,"id":"CVE-2009-3953","aliases":[],"status":"published","duplicateOf":null,"title":"Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability","description":"The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994.","dates":{"published":"2010-01-13T19:00:00.000Z","modified":"2025-10-22T00:05:53.712Z","reserved":null,"kevAdded":["2022-06-08T00:00:00.000Z"],"kevDue":["2022-06-22T00:00:00.000Z"]},"cvss":{"headline":{"score":10,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":10,"severity":"high","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.83219,"percentile":0.99678,"severity":"critical","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":-0.6360000000000032,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.83855},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.83855,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.83855,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.83855,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.83855,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.83855,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.83855,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.83855,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.83855,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.83855,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.83855,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.83219,"percentile":0.99678}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.83855,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.83855,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.83855,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.83855,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.83219,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.83219,"percentile":0.99678}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-06-08T00:00:00.000Z","dueDate":"2022-06-22T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability","description":"Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2009-3953","label":"nvd.nist.gov/vuln/detail/CVE-2009-3953"}],"vendor":"Adobe","product":"Acrobat and Reader","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-06-08T00:00:00.000Z","dueDate":"2022-06-22T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability","description":"Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2009-3953","label":"nvd.nist.gov/vuln/detail/CVE-2009-3953"}],"vendor":"Adobe","product":"Acrobat and Reader","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"16622","name":"Adobe - U3D CLODProgressiveMeshDeclaration Array Overrun (Metasploit) (2)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/16622","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"local","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"local","platform":"windows","file":"exploits/windows/local/16622.rb","codes":["CVE-2009-3953","OSVDB-61690"]},"metasploit":null},{"id":"MSF_EXPLOIT_WINDOWS_FILEFORMAT_ADOBE_U3D_MESHDECL","name":"Adobe U3D CLODProgressiveMeshDeclaration Array Overrun","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/windows/fileformat/adobe_u3d_meshdecl.rb","maturity":"weaponized","reliabilityScore":0.6666666666666666,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/windows/fileformat/adobe_u3d_meshdecl","rank":"400","rankName":"good","postAuth":false,"check":false,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}}],"exploitCount":2,"weaknesses":[{"id":"CWE-787","name":"Out-of-bounds Write","description":"The product writes data past the end, or before the beginning, of the intended buffer.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/787.html"}],"affected":[{"vendor":"adobe","product":"acrobat","name":"Acrobat","label":"acrobat","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 7.0, < 7.1.4","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0, < 8.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0, < 9.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.0, < 7.1.4 | ≥ 8.0, < 8.2 | ≥ 9.0, < 9.3","eol":null,"hubHref":"/vendor/adobe/acrobat"},{"vendor":"opensuse","product":"opensuse","name":"opensuse","label":"opensuse","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"11.1","noFixRecorded":false,"fixedIn":null},{"text":"11.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"11.1 | 11.2","eol":{"isEol":true,"eolDate":"2011-01-14T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"11.1","label":"11.1","eolFrom":"2011-01-14T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"opensuse","label":"openSUSE","category":"os"}},"hubHref":"/vendor/opensuse/opensuse"},{"vendor":"suse","product":"linux_enterprise","name":"linux enterprise","label":"linux_enterprise","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"10.0:sp2","noFixRecorded":false,"fixedIn":null},{"text":"10.0:sp3","noFixRecorded":false,"fixedIn":null}],"versionsText":"10.0:sp2 | 10.0:sp3","eol":null,"hubHref":"/vendor/suse/linux_enterprise"},{"vendor":"suse","product":"linux_enterprise_debuginfo","name":"linux enterprise debuginfo","label":"linux_enterprise_debuginfo","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"11","noFixRecorded":false,"fixedIn":null}],"versionsText":"11","eol":null,"hubHref":"/vendor/suse/linux_enterprise_debuginfo"}],"affectedCount":4,"eol":{"hasEol":true,"count":1},"references":[{"url":"http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl","label":"www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl","hostname":"www.metasploit.com","tags":["X Refsource MISC","Third Party Advisory"]},{"url":"http://secunia.com/advisories/38138","label":"secunia.com/advisories/38138","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL","Broken Link"]},{"url":"http://www.adobe.com/support/security/bulletins/apsb10-02.html","label":"www.adobe.com/support/security/bulletins/apsb10-02.html","hostname":"www.adobe.com","tags":["X Refsource CONFIRM","Not Applicable","Patch","Vendor Advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0060.html","label":"www.redhat.com/support/errata/RHSA-2010-0060.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Broken Link"]},{"url":"http://www.vupen.com/english/advisories/2010/0103","label":"www.vupen.com/english/advisories/2010/0103","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Broken Link","Vendor Advisory"]},{"url":"http://www.securitytracker.com/id?1023446","label":"www.securitytracker.com/id?1023446","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"http://osvdb.org/61690","label":"osvdb.org/61690","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB","Broken Link"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=554293","label":"bugzilla.redhat.com/show_bug.cgi?id=554293","hostname":"bugzilla.redhat.com","tags":["X Refsource CONFIRM","Issue Tracking"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/55551","label":"exchange.xforce.ibmcloud.com/vulnerabilities/55551","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF","Third Party Advisory"]},{"url":"http://secunia.com/advisories/38215","label":"secunia.com/advisories/38215","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html","label":"lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Mailing List","Third Party Advisory"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA10-013A.html","label":"www.us-cert.gov/cas/techalerts/TA10-013A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"http://www.securityfocus.com/bid/37758","label":"www.securityfocus.com/bid/37758","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3953","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3953","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":["RHSA-2010:0037","RHSA-2010:0038","RHSA-2010:0060"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2010-01-13T19:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-06-08T00:00:00.000Z","label":"Added to CISA KEV","detail":"Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-06-22T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-22T00:05:53.712Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T22:43:21.189Z","stale":false,"partial":false}}