{"id":"CVE-2009-4324","kind":"vulnerability","aliases":["CVE-2009-4324"],"related":[],"title":"Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x…","description":"Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.","summary":"Adobe Acrobat and Reader have a use-after-free bug that lets a crafted PDF file run code on the victim's machine. It is listed as actively exploited in the wild.","severity":"critical","cvss":9.3,"epss":0.8188,"exploited":true,"exploited_at":"2022-06-08T00:00:00+00:00","products":[{"name":"Adobe Acrobat and Reader","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"adobe acrobat","fixed":["8.2"],"affected":">= 8.0, < 8.2","ecosystem":"vendor"},{"name":"adobe acrobat","fixed":["9.3"],"affected":">= 9.0, < 9.3","ecosystem":"vendor"},{"name":"adobe acrobat reader","fixed":["8.2"],"affected":">= 8.0, < 8.2","ecosystem":"vendor"},{"name":"adobe acrobat reader","fixed":["9.3"],"affected":">= 9.0, < 9.3","ecosystem":"vendor"},{"name":"suse linux enterprise debuginfo","fixed":[],"affected":"= 11","ecosystem":"vendor"},{"name":"opensuse","fixed":[],"affected":"= 11.1","ecosystem":"vendor"},{"name":"opensuse","fixed":[],"affected":"= 11.2","ecosystem":"vendor"},{"name":"suse linux enterprise","fixed":[],"affected":"= 10.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe-acrobat","adobe-reader","desktop","exploited","macos","package","windows"],"not_affected_if":["acrobat-not-installed"],"how_to_check":"Open Acrobat or Reader and check Help > About for the installed version; compare it against the vendor's fixed release for this CVE.","fix":"Update Adobe Acrobat and Reader to the latest vendor release, per CISA's required action (apply updates per vendor instructions).","status":"open","published_at":"2009-12-15T02:30:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:12:47+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:12:47Z","model":"claude-haiku-5-5","output":{"fix":"Update Adobe Acrobat and Reader to the latest vendor release, per CISA's required action (apply updates per vendor instructions).","reach":"internet","impact":"high","summary":"Adobe Acrobat and Reader have a use-after-free bug that lets a crafted PDF file run code on the victim's machine. It is listed as actively exploited in the wild.","category":"package","who_cares":["adobe-acrobat","adobe-reader","windows","macos","desktop"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code on the machine after the victim opens a crafted PDF","analyst_note":"Sources do not give affected or fixed version numbers; pull the Adobe security bulletin for CVE-2009-4324 to name the exact fixed build.","how_to_check":"Open Acrobat or Reader and check Help > About for the installed version; compare it against the vendor's fixed release for this CVE.","needs_analyst":true,"not_affected_if":["acrobat-not-installed"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000478,"input_tokens":2838,"output_tokens":388,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2009':20A,23A '-4324':21A,24A '2009':146C '8':113C '8.2':116C '9':17A,108C '9.3':111C 'acrobat':16A,26A,30A,32A,34A,37A,50B,60B,107C 'activ':87B 'adob':13A,49B,52B,59B,104C 'adobe':25A,29A,31A,33A,36A 'adobe-acrobat':48B 'adobe-read':51B 'allow':123C 'and':27A 'arbitrari':128C 'attack':125C 'bug':69B 'code':77B,129C 'compress':137C 'craft':73B,132C 'cve':19A,22A 'debuginfo':42A 'decemb':145C 'desktop':54B 'doc.media.newplayer':8A,99C 'enterprise':41A,47A 'execut':127C 'exploit':55B,88B,140C 'file':75B,134C 'free':4A,68B,95C 'let':71B 'linux':40A,46A 'list':85B 'mac':120C 'machin':82B 'maco':56B 'method':9A,100C 'multimedia.api':11A,102C 'opensuse':43A,44A 'os':121C 'packag':57B 'pdf':74B,133C 'reader':14A,28A,35A,38A,53B,62B,105C 'remot':124C 'run':76B 'stream':138C 'suse':39A,45A 'use':2A,66B,93C,135C 'use-after-fre':1A,65B,92C 'via':130C 'victim':80B 'vulner':5A,96C 'wild':91B,143C 'window':58B,118C 'x':18A,109C,114C,122C 'zlib':136C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2009-12-15T02:30:00+00:00","kev":{"dateAdded":"2022-06-08","dueDate":"2022-06-22","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2009-4324","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-4324","severity":null,"published_at":"2022-06-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T16:39:48+00:00","note":null},{"source":"epss","external_id":"CVE-2009-4324","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-4324","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2009-4324","url":"https://nvd.nist.gov/vuln/detail/CVE-2009-4324","severity":null,"published_at":"2009-12-15T02:30:00+00:00","modified_at":"2026-06-16T23:13:26+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}