Live › vulnerability › CVE-2009-4324
Go to dashboardAdobe Acrobat and Reader have a use-after-free bug that lets a crafted PDF file run code on the victim's machine. It is listed as actively exploited in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Adobe Acrobat and Reader | vendor | – | – |
| adobe acrobat | vendor | >= 8.0, < 8.2 | 8.2 |
| adobe acrobat | vendor | >= 9.0, < 9.3 | 9.3 |
| adobe acrobat reader | vendor | >= 8.0, < 8.2 | 8.2 |
| adobe acrobat reader | vendor | >= 9.0, < 9.3 | 9.3 |
| suse linux enterprise debuginfo | vendor | = 11 | – |
| opensuse | vendor | = 11.1 | – |
| opensuse | vendor | = 11.2 | – |
| suse linux enterprise | vendor | = 10.0 | – |
Open Acrobat or Reader and check Help > About for the installed version; compare it against the vendor's fixed release for this CVE.
Update Adobe Acrobat and Reader to the latest vendor release, per CISA's required action (apply updates per vendor instructions).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
This page as .md · .json · in your agent: get_signal("CVE-2009-4324")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.