CVE-2009-1492

Name: CVE-2009-1492
Creator: NVD / NIST
Published: 2009-04-30T20:30:00.657+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 25.52%

Last modified Jun 16, 2026

CVE-2009-1492 is a vulnerability of currently unknown severity. The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that contains an annotation, and has an OpenAction entry with JavaScript code that calls this method with crafted integer arguments.. EPSS estimates a 25.52% chance of exploitation in the next 30 days.

Description

The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that contains an annotation, and has an OpenAction entry with JavaScript code that calls this method with crafted integer arguments.

Metrics

EPSS Probability

25.52%

97.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-399

Affected Software

Vendor	Product	Versions
Adobe	Acrobat	>= 7.0, <= 7.1.1
Adobe	Acrobat	>= 8.0, <= 8.1.4
Adobe	Acrobat	>= 9.0, <= 9.1
Adobe	Acrobat Reader	>= 7.0, <= 7.1.1
Adobe	Acrobat Reader	>= 8.0, <= 8.1.4
Adobe	Acrobat Reader	>= 9.0, <= 9.1

References

http://blogs.adobe.com/psirt/2009/04/potential_adobe_reader_issue.htmlVendor Advisory
http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.htmlVendor Advisory
http://blogs.adobe.com/psirt/2009/05/adobe_reader_issue_update.htmlVendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00001.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.htmlMailing List, Third Party Advisory
http://osvdb.org/54130Broken Link
http://packetstorm.linuxsecurity.com/0904-exploits/getannots.txtExploit, Third Party Advisory
http://secunia.com/advisories/34924Third Party Advisory
http://secunia.com/advisories/35055Third Party Advisory
http://secunia.com/advisories/35096Third Party Advisory
http://secunia.com/advisories/35152Third Party Advisory
http://secunia.com/advisories/35358Third Party Advisory
http://secunia.com/advisories/35416Third Party Advisory
http://secunia.com/advisories/35734Third Party Advisory
http://security.gentoo.org/glsa/glsa-200907-06.xmlThird Party Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-259028-1Broken Link
http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=926953Third Party Advisory
http://www.adobe.com/support/security/bulletins/apsb09-06.htmlVendor Advisory
http://www.kb.cert.org/vuls/id/970180Third Party Advisory, US Government Resource
http://www.redhat.com/support/errata/RHSA-2009-0478.htmlThird Party Advisory
http://www.securityfocus.com/bid/34736Exploit, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1022139Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-133B.htmlThird Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2009/1189Third Party Advisory
http://www.vupen.com/english/advisories/2009/1317Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/50145Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/8569Third Party Advisory, VDB Entry
http://blogs.adobe.com/psirt/2009/04/potential_adobe_reader_issue.htmlVendor Advisory
http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.htmlVendor Advisory
http://blogs.adobe.com/psirt/2009/05/adobe_reader_issue_update.htmlVendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00001.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.htmlMailing List, Third Party Advisory
http://osvdb.org/54130Broken Link
http://packetstorm.linuxsecurity.com/0904-exploits/getannots.txtExploit, Third Party Advisory
http://secunia.com/advisories/34924Third Party Advisory
http://secunia.com/advisories/35055Third Party Advisory
http://secunia.com/advisories/35096Third Party Advisory
http://secunia.com/advisories/35152Third Party Advisory
http://secunia.com/advisories/35358Third Party Advisory
http://secunia.com/advisories/35416Third Party Advisory
http://secunia.com/advisories/35734Third Party Advisory
http://security.gentoo.org/glsa/glsa-200907-06.xmlThird Party Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-259028-1Broken Link
http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=926953Third Party Advisory
http://www.adobe.com/support/security/bulletins/apsb09-06.htmlVendor Advisory
http://www.kb.cert.org/vuls/id/970180Third Party Advisory, US Government Resource
http://www.redhat.com/support/errata/RHSA-2009-0478.htmlThird Party Advisory
http://www.securityfocus.com/bid/34736Exploit, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1022139Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-133B.htmlThird Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2009/1189Third Party Advisory
http://www.vupen.com/english/advisories/2009/1317Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/50145Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/8569Third Party Advisory, VDB Entry

Timeline

Published: Apr 30, 2009
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2009-1492?

How severe is CVE-2009-1492?

Severity scoring for CVE-2009-1492 is pending analysis. The EPSS model estimates a 25.52% probability of exploitation in the next 30 days.

How do I fix CVE-2009-1492?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2009-1492?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST