---
id: "CVE-2009-4324"
kind: "vulnerability"
aliases: ["CVE-2009-4324"]
title: "Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x\u2026"
severity: "critical"
cvss: 9.3
epss: 0.8188
exploited: true
status: "open"
category: "package"
products: [{"name": "Adobe Acrobat and Reader", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "adobe acrobat", "fixed": ["8.2"], "affected": ">= 8.0, < 8.2", "ecosystem": "vendor"}, {"name": "adobe acrobat", "fixed": ["9.3"], "affected": ">= 9.0, < 9.3", "ecosystem": "vendor"}, {"name": "adobe acrobat reader", "fixed": ["8.2"], "affected": ">= 8.0, < 8.2", "ecosystem": "vendor"}, {"name": "adobe acrobat reader", "fixed": ["9.3"], "affected": ">= 9.0, < 9.3", "ecosystem": "vendor"}, {"name": "suse linux enterprise debuginfo", "fixed": [], "affected": "= 11", "ecosystem": "vendor"}, {"name": "opensuse", "fixed": [], "affected": "= 11.1", "ecosystem": "vendor"}, {"name": "opensuse", "fixed": [], "affected": "= 11.2", "ecosystem": "vendor"}, {"name": "suse linux enterprise", "fixed": [], "affected": "= 10.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe-acrobat", "adobe-reader", "desktop", "exploited", "macos", "package", "windows"]
not_affected_if: ["acrobat-not-installed"]
published_at: "2009-12-15T02:30:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-4324", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2009-4324", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4324", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x…

Adobe Acrobat and Reader have a use-after-free bug that lets a crafted PDF file run code on the victim's machine. It is listed as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Acrobat and Reader affected ? fixed ?
- vendor:adobe acrobat affected >= 8.0, < 8.2 fixed 8.2
- vendor:adobe acrobat affected >= 9.0, < 9.3 fixed 9.3
- vendor:adobe acrobat reader affected >= 8.0, < 8.2 fixed 8.2
- vendor:adobe acrobat reader affected >= 9.0, < 9.3 fixed 9.3
- vendor:suse linux enterprise debuginfo affected = 11 fixed ?
- vendor:opensuse affected = 11.1 fixed ?
- vendor:opensuse affected = 11.2 fixed ?
- vendor:suse linux enterprise affected = 10.0 fixed ?

## How to check

Open Acrobat or Reader and check Help > About for the installed version; compare it against the vendor's fixed release for this CVE.

## Fix

Update Adobe Acrobat and Reader to the latest vendor release, per CISA's required action (apply updates per vendor instructions).

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-4324
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2009-4324
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2009-4324

## From the sources

Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_