{"schemaVersion":3,"id":"CVE-2009-4324","aliases":[],"status":"published","duplicateOf":null,"title":"Adobe Acrobat and Reader Use-After-Free Vulnerability","description":"Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.","dates":{"published":"2009-12-15T02:00:00.000Z","modified":"2025-10-22T00:05:53.934Z","reserved":null,"kevAdded":["2022-06-08T00:00:00.000Z"],"kevDue":["2022-06-22T00:00:00.000Z"]},"cvss":{"headline":{"score":9.3,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9.3,"severity":"high","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.8188,"percentile":0.99648,"severity":"critical","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":-0.053000000000003045,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.81933},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.81933,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.81933,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.81933,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.81933,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.81933,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.81933,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.81933,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.81933,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.81933,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.81933,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.8188,"percentile":0.99648}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.81933,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.81933,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.81933,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.81933,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.8188,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.8188,"percentile":0.99648}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-06-08T00:00:00.000Z","dueDate":"2022-06-22T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Adobe Acrobat and Reader Use-After-Free Vulnerability","description":"Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2009-4324","label":"nvd.nist.gov/vuln/detail/CVE-2009-4324"}],"vendor":"Adobe","product":"Acrobat and Reader","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-06-08T00:00:00.000Z","dueDate":"2022-06-22T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Adobe Acrobat and Reader Use-After-Free Vulnerability","description":"Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2009-4324","label":"nvd.nist.gov/vuln/detail/CVE-2009-4324"}],"vendor":"Adobe","product":"Acrobat and Reader","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_043B7C006A5009FA","name":"Exploit Reference (contagiodump.blogspot.com)","source":"reference","url":"http://contagiodump.blogspot.com/2009/12/virustotal-httpwww.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"16503","name":"Adobe - 'Doc.media.newPlayer' Use-After-Free (Metasploit) (1)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/16503","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"local","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"local","platform":"windows","file":"exploits/windows/local/16503.rb","codes":["CVE-2009-4324","OSVDB-60980"]},"metasploit":null},{"id":"16623","name":"Adobe - 'Doc.media.newPlayer' Use-After-Free (Metasploit) (2)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/16623","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"local","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"local","platform":"windows","file":"exploits/windows/local/16623.rb","codes":["CVE-2009-4324","OSVDB-60980"]},"metasploit":null},{"id":"10618","name":"Adobe Reader / Acrobat - '.PDF' File Overflow","source":"exploit-database","url":"https://www.exploit-db.com/exploits/10618","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"local","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"local","platform":"windows","file":"exploits/windows/local/10618.py","codes":["CVE-2009-4324","OSVDB-60980"]},"metasploit":null},{"id":"MSF_EXPLOIT_WINDOWS_BROWSER_ADOBE_MEDIA_NEWPLAYER","name":"Adobe Doc.media.newPlayer Use After Free Vulnerability","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/windows/browser/adobe_media_newplayer.rb","maturity":"weaponized","reliabilityScore":0.6666666666666666,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/windows/browser/adobe_media_newplayer","rank":"400","rankName":"good","postAuth":false,"check":false,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}},{"id":"MSF_EXPLOIT_WINDOWS_FILEFORMAT_ADOBE_MEDIA_NEWPLAYER","name":"Adobe Doc.media.newPlayer Use After Free Vulnerability","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/windows/fileformat/adobe_media_newplayer.rb","maturity":"weaponized","reliabilityScore":0.6666666666666666,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/windows/fileformat/adobe_media_newplayer","rank":"400","rankName":"good","postAuth":false,"check":false,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}}],"exploitCount":6,"weaknesses":[{"id":"CWE-416","name":"Use After Free","description":"The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory \"belongs\" to the code that operates on the new pointer.","type":"weakness","status":"Stable","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/416.html"}],"affected":[{"vendor":"adobe","product":"acrobat","name":"Acrobat","label":"acrobat","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 8.0, < 8.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0, < 9.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 8.0, < 8.2 | ≥ 9.0, < 9.3","eol":null,"hubHref":"/vendor/adobe/acrobat"},{"vendor":"adobe","product":"acrobat_reader","name":"acrobat reader","label":"acrobat_reader","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 8.0, < 8.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0, < 9.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 8.0, < 8.2 | ≥ 9.0, < 9.3","eol":null,"hubHref":"/vendor/adobe/acrobat_reader"},{"vendor":"opensuse","product":"opensuse","name":"opensuse","label":"opensuse","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"11.1","noFixRecorded":false,"fixedIn":null},{"text":"11.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"11.1 | 11.2","eol":{"isEol":true,"eolDate":"2011-01-14T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"11.1","label":"11.1","eolFrom":"2011-01-14T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"opensuse","label":"openSUSE","category":"os"}},"hubHref":"/vendor/opensuse/opensuse"},{"vendor":"suse","product":"linux_enterprise","name":"linux enterprise","label":"linux_enterprise","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"10.0:sp2","noFixRecorded":false,"fixedIn":null},{"text":"10.0:sp3","noFixRecorded":false,"fixedIn":null}],"versionsText":"10.0:sp2 | 10.0:sp3","eol":null,"hubHref":"/vendor/suse/linux_enterprise"},{"vendor":"suse","product":"linux_enterprise_debuginfo","name":"linux enterprise debuginfo","label":"linux_enterprise_debuginfo","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"11","noFixRecorded":false,"fixedIn":null}],"versionsText":"11","eol":null,"hubHref":"/vendor/suse/linux_enterprise_debuginfo"}],"affectedCount":5,"eol":{"hasEol":true,"count":1},"references":[{"url":"http://www.securityfocus.com/bid/37331","label":"www.securityfocus.com/bid/37331","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Third Party Advisory"]},{"url":"http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html","label":"blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html","hostname":"blogs.adobe.com","tags":["X Refsource MISC","Broken Link","Vendor Advisory"]},{"url":"http://secunia.com/advisories/37690","label":"secunia.com/advisories/37690","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link","Vendor Advisory"]},{"url":"http://secunia.com/advisories/38138","label":"secunia.com/advisories/38138","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=547799","label":"bugzilla.redhat.com/show_bug.cgi?id=547799","hostname":"bugzilla.redhat.com","tags":["X Refsource CONFIRM","Issue Tracking"]},{"url":"http://osvdb.org/60980","label":"osvdb.org/60980","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB","Broken Link"]},{"url":"http://www.kb.cert.org/vuls/id/508357","label":"www.kb.cert.org/vuls/id/508357","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN","US Government Resource"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/54747","label":"exchange.xforce.ibmcloud.com/vulnerabilities/54747","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2009/3518","label":"www.vupen.com/english/advisories/2009/3518","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Broken Link","Vendor Advisory"]},{"url":"http://www.metasploit.com/redmine/projects/framework/repository/revisions/7881/entry/modules/exploits/windows/fileformat/adobe_media_newplayer.rb","label":"www.metasploit.com/redmine/…","hostname":"www.metasploit.com","tags":["X Refsource MISC","Broken Link"]},{"url":"http://www.adobe.com/support/security/bulletins/apsb10-02.html","label":"www.adobe.com/support/security/bulletins/apsb10-02.html","hostname":"www.adobe.com","tags":["X Refsource CONFIRM","Not Applicable"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6795","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6795","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL","Broken Link"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0060.html","label":"www.redhat.com/support/errata/RHSA-2010-0060.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Broken Link"]},{"url":"http://contagiodump.blogspot.com/2009/12/virustotal-httpwww.html","label":"contagiodump.blogspot.com/2009/12/virustotal-httpwww.html","hostname":"contagiodump.blogspot.com","tags":["X Refsource MISC","Exploit","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/0103","label":"www.vupen.com/english/advisories/2010/0103","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Broken Link"]},{"url":"http://www.adobe.com/support/security/advisories/apsa09-07.html","label":"www.adobe.com/support/security/advisories/apsa09-07.html","hostname":"www.adobe.com","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://www.symantec.com/connect/blogs/zero-day-xmas-present","label":"www.symantec.com/connect/blogs/zero-day-xmas-present","hostname":"www.symantec.com","tags":["X Refsource MISC","Broken Link"]},{"url":"http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20091214","label":"www.shadowserver.org/wiki/pmwiki.php/Calendar/20091214","hostname":"www.shadowserver.org","tags":["X Refsource MISC","Broken Link"]},{"url":"http://secunia.com/advisories/38215","label":"secunia.com/advisories/38215","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html","label":"lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Mailing List","Third Party Advisory"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA10-013A.html","label":"www.us-cert.gov/cas/techalerts/TA10-013A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-4324","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-4324","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":["RHSA-2010:0037","RHSA-2010:0038","RHSA-2010:0060"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2009-12-15T02:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-06-08T00:00:00.000Z","label":"Added to CISA KEV","detail":"Adobe Acrobat and Reader Use-After-Free Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-06-22T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-22T00:05:53.934Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T03:41:01.215Z","stale":false,"partial":false}}