CVE-2009-3459

HIGH

8.8

CVSS Score

Published: October 13, 2009 at 10:00 AM UTC

Updated: June 16, 2026 at 11:11 PM UTC

2 products affected across 1 vendorAcrobat ReaderAcrobat

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploitation

CISA KEV

Exploit prediction

EPSS 87%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score86.6%

EPSS (Exploit Prediction Scoring System) estimates a 86.6% chance this CVE is exploited in the wild within the next 30 days — higher than 100% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.

Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware Use

Unknown

Added to KEV

May 20, 2026

Remediation Due

Jun 3, 2026

147 days overdue

Notes

https://www.cisa.gov/news-events/alerts/2009/10/13/adobe-reader-and-acrobat-vulnerabilities

https://web.archive.org/web/20120324170253/http://www.adobe.com/support/security/bulletins/apsb09-15.html#:~:text=CVE%2D2009%2D3459).-,NOTE%3A,-There%20are%20reports

https://nvd.nist.gov/vuln/detail/CVE-2009-3459

Description

Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.