{"id":"CVE-2009-3953","kind":"vulnerability","aliases":["CVE-2009-3953"],"related":[],"title":"The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x…","description":"The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994.","summary":"Adobe Acrobat and Reader have an array boundary flaw in their Universal 3D (U3D) support. A malicious PDF can run code on the machine that opens it.","severity":"critical","cvss":10.0,"epss":0.83219,"exploited":true,"exploited_at":"2022-06-08T00:00:00+00:00","products":[{"name":"Adobe Acrobat and Reader","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"adobe acrobat","fixed":["7.1.4"],"affected":">= 7.0, < 7.1.4","ecosystem":"vendor"},{"name":"adobe acrobat","fixed":["8.2"],"affected":">= 8.0, < 8.2","ecosystem":"vendor"},{"name":"adobe acrobat","fixed":["9.3"],"affected":">= 9.0, < 9.3","ecosystem":"vendor"},{"name":"suse linux enterprise debuginfo","fixed":[],"affected":"= 11","ecosystem":"vendor"},{"name":"opensuse","fixed":[],"affected":"= 11.1","ecosystem":"vendor"},{"name":"opensuse","fixed":[],"affected":"= 11.2","ecosystem":"vendor"},{"name":"suse linux enterprise","fixed":[],"affected":"= 10.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe-acrobat","adobe-reader","exploited","macos","package","windows"],"not_affected_if":["no-acrobat-or-reader-installed","patched-version"],"how_to_check":null,"fix":"Update Adobe Acrobat and Reader to a version that includes the vendor fix; CISA says to apply updates per vendor instructions. Exact fixed version: unknown","status":"open","published_at":"2010-01-13T19:30:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:12:40+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:12:40Z","model":"claude-haiku-5-5","output":{"fix":"Update Adobe Acrobat and Reader to a version that includes the vendor fix; CISA says to apply updates per vendor instructions. Exact fixed version: unknown","reach":"internet","impact":"high","summary":"Adobe Acrobat and Reader have an array boundary flaw in their Universal 3D (U3D) support. A malicious PDF can run code on the machine that opens it.","category":"package","who_cares":["adobe-acrobat","adobe-reader","windows","macos"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code on the victim's machine via a crafted PDF","analyst_note":"Confirm fixed version numbers and the how-to-check method from Adobe's security bulletin for CVE-2009-3953 (APSB09-15 is the likely advisory; verify).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-version","no-acrobat-or-reader-installed"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000472,"input_tokens":2845,"output_tokens":374,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2009':27A,30A,141C '-2994':142C '-3953':28A,31A '3d':73B '7':24A,110C '7.1.4':113C '8':13A,99C '8.2':16A,102C '9':9A,95C '9.3':12A,98C 'acrobat':8A,33A,37A,39A,41A,53B,62B,94C 'adob':5A,52B,55B,61B,91C 'adobe':32A,36A,38A,40A 'adobe-acrobat':51B 'adobe-read':54B 'allow':114C 'and':34A 'arbitrari':119C 'array':67B,133C 'attack':116C 'boundari':68B,134C 'clodprogressivemeshdeclar':132C 'code':81B,120C 'cve':26A,29A,140C 'data':124C 'debuginfo':45A 'differ':137C 'document':128C 'enterprise':44A,50A 'execut':118C 'exploit':57B 'flaw':69B 'implement':3A,89C 'issu':135C 'linux':43A,49A 'mac':20A,106C 'machin':84B 'maco':58B 'malform':122C 'malici':77B 'open':86B 'opensuse':46A,47A 'os':21A,107C 'packag':59B 'pdf':78B,127C 'reader':6A,35A,56B,64B,92C 'relat':129C 'remot':115C 'run':80B 'support':75B 'suse':42A,48A 'u3d':2A,74B,88C,123C 'univers':72B 'via':121C 'vulner':138C 'window':18A,60B,104C 'x':10A,14A,22A,25A,96C,100C,108C,111C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2010-01-13T19:30:00+00:00","kev":{"dateAdded":"2022-06-08","dueDate":"2022-06-22","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2009-3953","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-3953","severity":null,"published_at":"2022-06-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"epss","external_id":"CVE-2009-3953","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-3953","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2009-3953","url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3953","severity":null,"published_at":"2010-01-13T19:30:00+00:00","modified_at":"2026-06-16T23:12:41+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}