CVE-2009-3459
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 3 June 2026). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 86.65% probability · 100th percentile
- Public exploits
- 2 in Exploit-DB · verified · first 20 September 2010
- CISA KEV
- Listed 20 May 2026 · due 3 June 2026
- Weakness
- CWE-119, CWE-122
- Affected
- adobe/acrobat · adobe/acrobat reader
- Source
- psirt@adobe.com
EPSS 86.6% since 27 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
CISA notes
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://www.cisa.gov/news-events/alerts/2009/10/13/adobe-reader-and-acrobat-vulnerabilities ; https://web.archive.org/web/20120324170253/http://www.adobe.com/support/security/bulletins/apsb09-15.html#:~:text=CVE%2D2009%2D3459).-,NOTE%3A,-There%20are%20reports ; https://nvd.nist.gov/vuln/detail/CVE-2009-3459
Public exploits (2)
Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.
| EDB-ID | Title | Type | Published | Verified |
|---|---|---|---|---|
| EDB-16652source ↗ | Adobe - FlateDecode Stream Predictor 02 Integer Overflow (Metasploit) (2)windows · Metasploit | local | 25 September 2010 | yes |
| EDB-16546source ↗ | Adobe - FlateDecode Stream Predictor 02 Integer Overflow (Metasploit) (1)windows · Metasploit | local | 20 September 2010 | yes |
References
- http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.htmlBroken Link, Vendor Advisory
- http://isc.sans.org/diary.html?storyid=7300Not Applicable
- http://secunia.com/advisories/36983Vendor Advisory
- http://securitytracker.com/id?1023007Broken Link
- http://www.adobe.com/support/security/bulletins/apsb09-15.htmlPatch, Vendor Advisory
- http://www.iss.net/threats/348.htmlBroken Link
- http://www.securityfocus.com/bid/36600Broken Link
- http://www.us-cert.gov/cas/techalerts/TA09-286B.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2009/2851Vendor Advisory
- http://www.vupen.com/english/advisories/2009/2898Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53691Third Party Advisory, VDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534Broken Link
- http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.htmlBroken Link, Vendor Advisory
- http://isc.sans.org/diary.html?storyid=7300Not Applicable
- http://secunia.com/advisories/36983Vendor Advisory
- http://securitytracker.com/id?1023007Broken Link
- http://www.adobe.com/support/security/bulletins/apsb09-15.htmlPatch, Vendor Advisory
- http://www.iss.net/threats/348.htmlBroken Link
- http://www.securityfocus.com/bid/36600Broken Link
- http://www.us-cert.gov/cas/techalerts/TA09-286B.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2009/2851Vendor Advisory
- http://www.vupen.com/english/advisories/2009/2898Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53691Third Party Advisory, VDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534Broken Link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3459US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.