---
id: "CVE-2009-3953"
kind: "vulnerability"
aliases: ["CVE-2009-3953"]
title: "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x\u2026"
severity: "critical"
cvss: 10.0
epss: 0.83219
exploited: true
status: "open"
category: "package"
products: [{"name": "Adobe Acrobat and Reader", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "adobe acrobat", "fixed": ["7.1.4"], "affected": ">= 7.0, < 7.1.4", "ecosystem": "vendor"}, {"name": "adobe acrobat", "fixed": ["8.2"], "affected": ">= 8.0, < 8.2", "ecosystem": "vendor"}, {"name": "adobe acrobat", "fixed": ["9.3"], "affected": ">= 9.0, < 9.3", "ecosystem": "vendor"}, {"name": "suse linux enterprise debuginfo", "fixed": [], "affected": "= 11", "ecosystem": "vendor"}, {"name": "opensuse", "fixed": [], "affected": "= 11.1", "ecosystem": "vendor"}, {"name": "opensuse", "fixed": [], "affected": "= 11.2", "ecosystem": "vendor"}, {"name": "suse linux enterprise", "fixed": [], "affected": "= 10.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe-acrobat", "adobe-reader", "exploited", "macos", "package", "windows"]
not_affected_if: ["no-acrobat-or-reader-installed", "patched-version"]
published_at: "2010-01-13T19:30:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-3953", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2009-3953", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x…

Adobe Acrobat and Reader have an array boundary flaw in their Universal 3D (U3D) support. A malicious PDF can run code on the machine that opens it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Acrobat and Reader affected ? fixed ?
- vendor:adobe acrobat affected >= 7.0, < 7.1.4 fixed 7.1.4
- vendor:adobe acrobat affected >= 8.0, < 8.2 fixed 8.2
- vendor:adobe acrobat affected >= 9.0, < 9.3 fixed 9.3
- vendor:suse linux enterprise debuginfo affected = 11 fixed ?
- vendor:opensuse affected = 11.1 fixed ?
- vendor:opensuse affected = 11.2 fixed ?
- vendor:suse linux enterprise affected = 10.0 fixed ?

## Fix

Update Adobe Acrobat and Reader to a version that includes the vendor fix; CISA says to apply updates per vendor instructions. Exact fixed version: unknown

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-3953
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2009-3953
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2009-3953

## From the sources

The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_