CVE-2009-3459

Name: CVE-2009-3459
Creator: NVD / NIST
Published: 2009-10-13T10:30:00.577+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.8/10Actively ExploitedEPSS 86.47%

Last modified Jun 16, 2026

CVE-2009-3459 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.. CISA has confirmed active exploitation in the wild. EPSS estimates a 86.47% chance of exploitation in the next 30 days.

Description

Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Probability

86.47%

99.7th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by Jun 3, 2026.

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Adobe	Acrobat	>= 7.0, < 7.1.4
Adobe	Acrobat	>= 8.0, < 8.1.7
Adobe	Acrobat	>= 9.0, < 9.2
Adobe	Acrobat Reader	>= 7.0, < 7.1.4
Adobe	Acrobat Reader	>= 8.0, < 8.1.7
Adobe	Acrobat Reader	>= 9.0, < 9.2

References

http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.htmlBroken Link, Vendor Advisory
http://isc.sans.org/diary.html?storyid=7300Not Applicable
http://secunia.com/advisories/36983Vendor Advisory
http://securitytracker.com/id?1023007Broken Link
http://www.adobe.com/support/security/bulletins/apsb09-15.htmlPatch, Vendor Advisory
http://www.iss.net/threats/348.htmlBroken Link
http://www.securityfocus.com/bid/36600Broken Link
http://www.us-cert.gov/cas/techalerts/TA09-286B.htmlUS Government Resource
http://www.vupen.com/english/advisories/2009/2851Vendor Advisory
http://www.vupen.com/english/advisories/2009/2898Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/53691Third Party Advisory, VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534Broken Link
http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.htmlBroken Link, Vendor Advisory
http://isc.sans.org/diary.html?storyid=7300Not Applicable
http://secunia.com/advisories/36983Vendor Advisory
http://securitytracker.com/id?1023007Broken Link
http://www.adobe.com/support/security/bulletins/apsb09-15.htmlPatch, Vendor Advisory
http://www.iss.net/threats/348.htmlBroken Link
http://www.securityfocus.com/bid/36600Broken Link
http://www.us-cert.gov/cas/techalerts/TA09-286B.htmlUS Government Resource
http://www.vupen.com/english/advisories/2009/2851Vendor Advisory
http://www.vupen.com/english/advisories/2009/2898Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/53691Third Party Advisory, VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534Broken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3459US Government Resource

Timeline

Published: Oct 13, 2009
Last Modified: Jun 16, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2009-3459?

How severe is CVE-2009-3459?

CVE-2009-3459 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 86.47% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

How do I fix CVE-2009-3459?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2009-3459?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST