---
id: "CVE-2009-1862"
kind: "vulnerability"
aliases: ["CVE-2009-1862"]
title: "Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through\u2026"
severity: "critical"
cvss: 9.3
epss: 0.21198
exploited: true
status: "open"
category: "package"
products: [{"name": "Adobe Acrobat and Reader, Flash Player", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "adobe acrobat", "fixed": [], "affected": ">= 9.0, <= 9.1.2", "ecosystem": "vendor"}, {"name": "adobe acrobat reader", "fixed": [], "affected": ">= 9.0, <= 9.1.2", "ecosystem": "vendor"}, {"name": "adobe flash player", "fixed": [], "affected": ">= 9.0, <= 9.0.159.0", "ecosystem": "vendor"}, {"name": "adobe flash player", "fixed": [], "affected": ">= 10.0, <= 10.0.22.87", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["acrobat", "adobe-reader", "exploited", "flash-player", "macos", "package", "windows"]
not_affected_if: ["no-acrobat-or-reader-installed", "no-flash-player-installed"]
published_at: "2009-07-23T20:30:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-1862", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2009-1862", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1862", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through…

CVE-2009-1862 is an unspecified flaw in Adobe Acrobat, Adobe Reader and Flash Player that lets remote attackers execute code or cause a denial of service. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Acrobat and Reader, Flash Player affected ? fixed ?
- vendor:adobe acrobat affected >= 9.0, <= 9.1.2 fixed ?
- vendor:adobe acrobat reader affected >= 9.0, <= 9.1.2 fixed ?
- vendor:adobe flash player affected >= 9.0, <= 9.0.159.0 fixed ?
- vendor:adobe flash player affected >= 10.0, <= 10.0.22.87 fixed ?

## How to check

Check the installed Acrobat or Reader version under Help > About, and check whether Flash Player is present on any machine (Flash Player is end-of-life).

## Fix

For Acrobat and Reader, apply the vendor updates per Adobe's instructions. For Flash Player, uninstall it or disconnect the machine, since the product is end-of-life.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-1862
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2009-1862
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2009-1862

## From the sources

Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_