CVE-2009-3953

The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.

• CWE-787
• CWE-787

• http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.htmlMailing List, Third Party Advisory
• http://osvdb.org/61690Broken Link
• http://secunia.com/advisories/38138Broken Link
• http://secunia.com/advisories/38215Broken Link
• http://www.adobe.com/support/security/bulletins/apsb10-02.htmlNot Applicable, Patch, Vendor Advisory
• http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdeclThird Party Advisory
• http://www.redhat.com/support/errata/RHSA-2010-0060.htmlBroken Link
• http://www.securityfocus.com/bid/37758Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1023446Broken Link, Third Party Advisory, VDB Entry
• http://www.us-cert.gov/cas/techalerts/TA10-013A.htmlThird Party Advisory, US Government Resource
• http://www.vupen.com/english/advisories/2010/0103Broken Link, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=554293Issue Tracking
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55551Third Party Advisory, VDB Entry
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242Broken Link
• http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.htmlMailing List, Third Party Advisory
• http://osvdb.org/61690Broken Link
• http://secunia.com/advisories/38138Broken Link
• http://secunia.com/advisories/38215Broken Link
• http://www.adobe.com/support/security/bulletins/apsb10-02.htmlNot Applicable, Patch, Vendor Advisory
• http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdeclThird Party Advisory
• http://www.redhat.com/support/errata/RHSA-2010-0060.htmlBroken Link
• http://www.securityfocus.com/bid/37758Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1023446Broken Link, Third Party Advisory, VDB Entry
• http://www.us-cert.gov/cas/techalerts/TA10-013A.htmlThird Party Advisory, US Government Resource
• http://www.vupen.com/english/advisories/2010/0103Broken Link, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=554293Issue Tracking
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55551Third Party Advisory, VDB Entry
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242Broken Link
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3953US Government Resource

Published

Jan 13, 2010

Last Modified

Jun 16, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-3947Buffer overflow in the FTP service on the Tandberg MXP F7.0 …
• CVE-2009-3948JetAudio 7.5.3 COWON Media Center allows remote attackers to…
• CVE-2009-3949cp/profile.php in VivaPrograms Infinity 2.0.5 and earlier do…
• CVE-2009-3950Multiple cross-site scripting (XSS) vulnerabilities in Bract…
• CVE-2009-3951Unspecified vulnerability in the Flash Player ActiveX contro…
• CVE-2009-3952Buffer overflow in Adobe Illustrator CS3 13.0.3 and earlier …
• CVE-2009-3954The 3D implementation in Adobe Reader and Acrobat 9.x before…
• CVE-2009-3955Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 …
• CVE-2009-3956The default configuration of Adobe Reader and Acrobat 9.x be…
• CVE-2009-3957Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 …
• CVE-2009-3958Multiple stack-based buffer overflows in the NOS Microsystem…
• CVE-2009-3959Integer overflow in the U3D implementation in Adobe Reader a…