Vulnerability detail
Enriched intelligence for a single CVE
High
CVE-2009-3459
PUBLISHEDHeap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute...
6076 days faster than CISA KEV
- Vendor
- Adobe
- Product
- Reader and Acrobat
- Published
- Oct 13, 2009
- EPSS
- 88.1% · 100% pctl
Automate this intelligence with the Pro API
Everything on this page — CVSS, EPSS, exploit status, PoCs, scanner integrations, mentions, tags, and immediate honeypot data — is available programmatically for VM, SOC, and CTI workflows.
Description
Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.
CVSS scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:N/AC:M/Au:N/C:C/I:C/A:C
Exploitation status
Exploited in the wild
Recorded 2009-10-13 10:00:00 UTC · CVE
Proof of concept available
Recorded 2025-04-28 15:02:37 UTC
References
- http://secunia.com/advisories/36983
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534
- http://www.us-cert.gov/cas/techalerts/TA09-286B.html
- http://securitytracker.com/id?1023007
- http://www.adobe.com/support/security/bulletins/apsb09-15.html
- http://www.iss.net/threats/348.html
- http://www.vupen.com/english/advisories/2009/2851
- http://isc.sans.org/diary.html?storyid=7300
- http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html
- http://www.securityfocus.com/bid/36600
- http://www.vupen.com/english/advisories/2009/2898
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53691
Known exploited vulnerability sources
Catalogues that list this CVE as a known exploited vulnerability.
| Source | Added |
|---|---|
| CVE First | 2009-10-13 10:00 UTC |
| CISA | 2026-06-02 14:00 UTC |
Scanner integrations
| Scanner | Reference | Detected |
|---|---|---|
| Metasploit | https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/adobe_flatedecode_predictor02.rb | Apr 29, 2025 |
Potential proof of concepts
These PoCs are unverified and could contain malware. Use at your own risk.
Timeline
-
CVE ID Reserved
-
CVE Published to Public
-
Added to KEVIntel
-
Proof of Concept Exploit Available
-
Detected by Metasploit
-
KEV confirmed by CISA