# CVE-2009-3459

Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.

- Page: https://www.vulneraibility.com/cve/CVE-2009-3459
- CVSS: 8.8
- Known exploited: yes, in CISA KEV since 2026-05-20; CISA due date 2026-06-03
- EPSS: 86.65%
- Public exploit code: 2 on Exploit-DB · 2 Metasploit modules (first 2010-09-20)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2026-05-20)
- Weakness: CWE-122
- Published: 2009-10-13

## Affected

- adobe:acrobat
- adobe:acrobat_reader

## References

- [advisory] http://secunia.com/advisories/36983
- [other] https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534
- [advisory] http://www.us-cert.gov/cas/techalerts/TA09-286B.html
- [other] http://securitytracker.com/id?1023007
- [other] http://www.adobe.com/support/security/bulletins/apsb09-15.html
- [advisory] http://www.iss.net/threats/348.html
- [other] http://www.vupen.com/english/advisories/2009/2851
- [other] http://isc.sans.org/diary.html?storyid=7300
- [other] http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html
- [other] http://www.securityfocus.com/bid/36600
- [other] http://www.vupen.com/english/advisories/2009/2898
- [other] https://exchange.xforce.ibmcloud.com/vulnerabilities/53691
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3459

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.