{"id":"CVE-2009-3459","kind":"vulnerability","aliases":["CVE-2009-3459"],"related":[],"title":"Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows…","description":"Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"A heap-based buffer overflow in Adobe Acrobat and Reader lets a remote attacker run arbitrary code by getting a victim to open a crafted PDF. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":9.3,"epss":null,"exploited":true,"exploited_at":"2026-05-20T00:00:00+00:00","products":[{"name":"Adobe Acrobat and Reader","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"adobe acrobat","fixed":["7.1.4"],"affected":">= 7.0, < 7.1.4","ecosystem":"vendor"},{"name":"adobe acrobat","fixed":["8.1.7"],"affected":">= 8.0, < 8.1.7","ecosystem":"vendor"},{"name":"adobe acrobat","fixed":["9.2"],"affected":">= 9.0, < 9.2","ecosystem":"vendor"},{"name":"adobe acrobat reader","fixed":["7.1.4"],"affected":">= 7.0, < 7.1.4","ecosystem":"vendor"},{"name":"adobe acrobat reader","fixed":["8.1.7"],"affected":">= 8.0, < 8.1.7","ecosystem":"vendor"},{"name":"adobe acrobat reader","fixed":["9.2"],"affected":">= 9.0, < 9.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["acrobat","adobe-reader","exploited","macos","package","windows"],"not_affected_if":["product-not-installed"],"how_to_check":"Check the installed Acrobat or Reader version under Help > About; the affected and fixed version ranges are unknown in the sources.","fix":"Update Adobe Acrobat and Reader to a currently supported release, or remove the product if mitigations are unavailable, per the CISA required action.","status":"open","published_at":"2009-10-13T10:30:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:34:07+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:34:07Z","model":"claude-haiku-5-5","output":{"fix":"Update Adobe Acrobat and Reader to a currently supported release, or remove the product if mitigations are unavailable, per the CISA required action.\nunknown","summary":"A heap-based buffer overflow in Adobe Acrobat and Reader lets a remote attacker run arbitrary code by getting a victim to open a crafted PDF. CISA lists it as actively exploited in the wild.","category":"package","who_cares":["acrobat","adobe-reader","windows","macos"],"confidence":0.6,"analyst_note":"Sources do not give affected or fixed versions; check the Adobe security bulletin for the 2009 advisory and the fixed build numbers.","how_to_check":"Check the installed Acrobat or Reader version under Help > About; the affected and fixed version ranges are unknown in the sources.","needs_analyst":true,"not_affected_if":["product-not-installed"],"severity_if_unknown":"high"},"cost_usd":0.00037,"input_tokens":2098,"output_tokens":320,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':136C '-2009':26A,29A '-3459':27A,30A '22':135C '7':11A '7.1.4':14A '8':15A '8.1.7':18A '9':20A '9.2':23A 'acrobat':10A,32A,36A,38A,40A,42A,45A,48A,50B,66B,95C 'action':126C 'activ':89B 'adob':7A,52B,65B,94C 'adobe':31A,35A,37A,39A,41A,44A,47A 'adobe-read':51B 'allow':24A,108C 'and':33A 'appli':127C 'applic':133C 'arbitrari':74B,113C 'attack':72B,110C 'base':3A,61B,102C 'bod':134C 'buffer':4A,62B,103C 'cisa':85B,124C 'cloud':139C 'code':75B,114C 'contain':98C 'corrupt':123C 'could':107C 'craft':83B,117C 'cve':25A,28A 'discontinu':142C 'execut':112C 'exploit':54B,90B 'file':119C 'follow':132C 'get':77B 'guidanc':137C 'heap':2A,60B,101C 'heap-bas':1A,59B,100C 'instruct':131C 'let':69B 'list':86B 'maco':55B 'memori':122C 'mitig':128C,148C 'open':81B 'overflow':5A,63B,104C 'packag':56B 'pdf':84B,118C 'per':129C 'product':146C 'reader':8A,34A,43A,46A,49A,53B,68B,97C 'remot':71B,109C 'requir':125C 'run':73B 'servic':140C 'trigger':121C 'unavail':150C 'use':143C 'vendor':130C 'via':115C 'victim':79B 'vulner':105C 'wild':93B 'window':57B 'x':12A,16A,21A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2009-10-13T10:30:00+00:00","kev":{"dateAdded":"2026-05-20","dueDate":"2026-06-03","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2009-3459","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-3459","severity":null,"published_at":"2026-05-20T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:14+00:00","note":null},{"source":"nvd","external_id":"CVE-2009-3459","url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3459","severity":null,"published_at":"2009-10-13T10:30:00+00:00","modified_at":"2026-06-16T23:11:38+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}