{"history":[{"alert":0,"cve":"CVE-2009-3459","id":21417,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.86531, \"percentile\": 0.99743}"},{"alert":0,"cve":"CVE-2009-3459","id":19033,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.86531, \"percentile\": 0.99741}"},{"alert":0,"cve":"CVE-2009-3459","id":16999,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.86531, \"percentile\": 0.99741}"},{"alert":0,"cve":"CVE-2009-3459","id":15062,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.86531, \"percentile\": 0.99741}"},{"alert":1,"cve":"CVE-2009-3459","id":14979,"kind":"cna","observed_at":1794090000,"payload":"{\"containers\": {\"adp\": [{\"providerMetadata\": {\"dateUpdated\": \"2024-08-07T06:31:10.547Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"name\": \"36983\", \"tags\": [\"third-party-advisory\", \"x_refsource_SECUNIA\", \"x_transferred\"], \"url\": \"http://secunia.com/advisories/36983\"}, {\"name\": \"oval:org.mitre.oval:def:6534\", \"tags\": [\"vdb-entry\", \"signature\", \"x_refsource_OVAL\", \"x_transferred\"], \"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534\"}, {\"name\": \"TA09-286B\", \"tags\": [\"third-party-advisory\", \"x_refsource_CERT\", \"x_transferred\"], \"url\": \"http://www.us-cert.gov/cas/techalerts/TA09-286B.html\"}, {\"name\": \"1023007\", \"tags\": [\"vdb-entry\", \"x_refsource_SECTRACK\", \"x_transferred\"], \"url\": \"http://securitytracker.com/id?1023007\"}, {\"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"], \"url\": \"http://www.adobe.com/support/security/bulletins/apsb09-15.html\"}, {\"name\": \"20091009 Adobe Acrobat and Acrobat Reader Remote Code Execution\", \"tags\": [\"third-party-advisory\", \"x_refsource_ISS\", \"x_transferred\"], \"url\": \"http://www.iss.net/threats/348.html\"}, {\"name\": \"ADV-2009-2851\", \"tags\": [\"vdb-entry\", \"x_refsource_VUPEN\", \"x_transferred\"], \"url\": \"http://www.vupen.com/english/advisories/2009/2851\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"http://isc.sans.org/diary.html?storyid=7300\"}, {\"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"], \"url\": \"http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html\"}, {\"name\": \"36600\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\", \"x_transferred\"], \"url\": \"http://www.securityfocus.com/bid/36600\"}, {\"name\": \"ADV-2009-2898\", \"tags\": [\"vdb-entry\", \"x_refsource_VUPEN\", \"x_transferred\"], \"url\": \"http://www.vupen.com/english/advisories/2009/2898\"}, {\"name\": \"adobe-reader-pdf-code-execution(53691)\", \"tags\": [\"vdb-entry\", \"x_refsource_XF\", \"x_transferred\"], \"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/53691\"}], \"title\": \"CVE Program Container\"}, {\"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"REQUIRED\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}}, {\"other\": {\"content\": {\"id\": \"CVE-2009-3459\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-05-20T00:00:00+00:00\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2026-05-20\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3459\"}, \"type\": \"kev\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-122\", \"description\": \"CWE-122 Heap-based Buffer Overflow\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-05-21T03:55:27.999Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3459\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-05-20T00:00:00.000Z\", \"value\": \"CVE-2009-3459 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \"n/a\", \"vendor\": \"n/a\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"datePublic\": \"2009-10-08T00:00:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.\"}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"n/a\", \"lang\": \"en\", \"type\": \"text\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2017-09-18T12:57:01.000Z\", \"orgId\": \"078d4453-3bcd-4900-85e6-15281da43538\", \"shortName\": \"adobe\"}, \"references\": [{\"name\": \"36983\", \"tags\": [\"third-party-advisory\", \"x_refsource_SECUNIA\"], \"url\": \"http://secunia.com/advisories/36983\"}, {\"name\": \"oval:org.mitre.oval:def:6534\", \"tags\": [\"vdb-entry\", \"signature\", \"x_refsource_OVAL\"], \"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534\"}, {\"name\": \"TA09-286B\", \"tags\": [\"third-party-advisory\", \"x_refsource_CERT\"], \"url\": \"http://www.us-cert.gov/cas/techalerts/TA09-286B.html\"}, {\"name\": \"1023007\", \"tags\": [\"vdb-entry\", \"x_refsource_SECTRACK\"], \"url\": \"http://securitytracker.com/id?1023007\"}, {\"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"http://www.adobe.com/support/security/bulletins/apsb09-15.html\"}, {\"name\": \"20091009 Adobe Acrobat and Acrobat Reader Remote Code Execution\", \"tags\": [\"third-party-advisory\", \"x_refsource_ISS\"], \"url\": \"http://www.iss.net/threats/348.html\"}, {\"name\": \"ADV-2009-2851\", \"tags\": [\"vdb-entry\", \"x_refsource_VUPEN\"], \"url\": \"http://www.vupen.com/english/advisories/2009/2851\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"http://isc.sans.org/diary.html?storyid=7300\"}, {\"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html\"}, {\"name\": \"36600\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\"], \"url\": \"http://www.securityfocus.com/bid/36600\"}, {\"name\": \"ADV-2009-2898\", \"tags\": [\"vdb-entry\", \"x_refsource_VUPEN\"], \"url\": \"http://www.vupen.com/english/advisories/2009/2898\"}, {\"name\": \"adobe-reader-pdf-code-execution(53691)\", \"tags\": [\"vdb-entry\", \"x_refsource_XF\"], \"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/53691\"}], \"x_legacyV4Record\": {\"CVE_data_meta\": {\"ASSIGNER\": \"psirt@adobe.com\", \"ID\": \"CVE-2009-3459\", \"STATE\": \"PUBLIC\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"n/a\", \"version\": {\"version_data\": [{\"version_value\": \"n/a\"}]}}]}, \"vendor_name\": \"n/a\"}]}}, \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"n/a\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"36983\", \"refsource\": \"SECUNIA\", \"url\": \"http://secunia.com/advisories/36983\"}, {\"name\": \"oval:org.mitre.oval:def:6534\", \"refsource\": \"OVAL\", \"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534\"}, {\"name\": \"TA09-286B\", \"refsource\": \"CERT\", \"url\": \"http://www.us-cert.gov/cas/techalerts/TA09-286B.html\"}, {\"name\": \"1023007\", \"refsource\": \"SECTRACK\", \"url\": \"http://securitytracker.com/id?1023007\"}, {\"name\": \"http://www.adobe.com/support/security/bulletins/apsb09-15.html\", \"refsource\": \"CONFIRM\", \"url\": \"http://www.adobe.com/support/security/bulletins/apsb09-15.html\"}, {\"name\": \"20091009 Adobe Acrobat and Acrobat Reader Remote Code Execution\", \"refsource\": \"ISS\", \"url\": \"http://www.iss.net/threats/348.html\"}, {\"name\": \"ADV-2009-2851\", \"refsource\": \"VUPEN\", \"url\": \"http://www.vupen.com/english/advisories/2009/2851\"}, {\"name\": \"http://isc.sans.org/diary.html?storyid=7300\", \"refsource\": \"MISC\", \"url\": \"http://isc.sans.org/diary.html?storyid=7300\"}, {\"name\": \"http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html\", \"refsource\": \"CONFIRM\", \"url\": \"http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html\"}, {\"name\": \"36600\", \"refsource\": \"BID\", \"url\": \"http://www.securityfocus.com/bid/36600\"}, {\"name\": \"ADV-2009-2898\", \"refsource\": \"VUPEN\", \"url\": \"http://www.vupen.com/english/advisories/2009/2898\"}, {\"name\": \"adobe-reader-pdf-code-execution(53691)\", \"refsource\": \"XF\", \"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/53691\"}]}}}}, \"cveMetadata\": {\"assignerOrgId\": \"078d4453-3bcd-4900-85e6-15281da43538\", \"assignerShortName\": \"adobe\", \"cveId\": \"CVE-2009-3459\", \"datePublished\": \"2009-10-13T10:00:00.000Z\", \"dateReserved\": \"2009-09-29T00:00:00.000Z\", \"dateUpdated\": \"2026-05-21T03:55:27.999Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":0,"cve":"CVE-2009-3459","id":13040,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.86531, \"percentile\": 0.9974}"},{"alert":0,"cve":"CVE-2009-3459","id":10822,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.86531, \"percentile\": 0.9974}"},{"alert":0,"cve":"CVE-2009-3459","id":8568,"kind":"epss","observed_at":1793895600,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.86531, \"percentile\": 0.9974}"},{"alert":0,"cve":"CVE-2009-3459","id":6356,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.86531, \"percentile\": 0.9974}"},{"alert":0,"cve":"CVE-2009-3459","id":4133,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.86646, \"percentile\": 0.9974}"},{"alert":0,"cve":"CVE-2009-3459","id":1915,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.86646, \"percentile\": 0.9974}"},{"alert":1,"cve":"CVE-2009-3459","id":170,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2009-3459\", \"cwes\": [\"CWE-119\"], \"dateAdded\": \"2026-05-20\", \"dueDate\": \"2026-06-03\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Unknown\", \"notes\": \"https://www.cisa.gov/news-events/alerts/2009/10/13/adobe-reader-and-acrobat-vulnerabilities ; https://web.archive.org/web/20120324170253/http://www.adobe.com/support/security/bulletins/apsb09-15.html#:~:text=CVE%2D2009%2D3459).-,NOTE%3A,-There%20are%20reports ; https://nvd.nist.gov/vuln/detail/CVE-2009-3459\", \"product\": \"Acrobat and Reader\", \"requiredAction\": \"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.\", \"shortDescription\": \"Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.\", \"vendorProject\": \"Adobe\", \"vulnerabilityName\": \"Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability\"}"}],"record":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T06:31:10.547Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"36983","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/36983"},{"name":"oval:org.mitre.oval:def:6534","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534"},{"name":"TA09-286B","tags":["third-party-advisory","x_refsource_CERT","x_transferred"],"url":"http://www.us-cert.gov/cas/techalerts/TA09-286B.html"},{"name":"1023007","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1023007"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.adobe.com/support/security/bulletins/apsb09-15.html"},{"name":"20091009 Adobe Acrobat and Acrobat Reader Remote Code Execution","tags":["third-party-advisory","x_refsource_ISS","x_transferred"],"url":"http://www.iss.net/threats/348.html"},{"name":"ADV-2009-2851","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2009/2851"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://isc.sans.org/diary.html?storyid=7300"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html"},{"name":"36600","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/36600"},{"name":"ADV-2009-2898","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2009/2898"},{"name":"adobe-reader-pdf-code-execution(53691)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/53691"}],"title":"CVE Program Container"},{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}},{"other":{"content":{"id":"CVE-2009-3459","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-20T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2026-05-20","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3459"},"type":"kev"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-122","description":"CWE-122 Heap-based Buffer Overflow","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-05-21T03:55:27.999Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3459"}],"timeline":[{"lang":"en","time":"2026-05-20T00:00:00.000Z","value":"CVE-2009-3459 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2009-10-08T00:00:00.000Z","descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-18T12:57:01.000Z","orgId":"078d4453-3bcd-4900-85e6-15281da43538","shortName":"adobe"},"references":[{"name":"36983","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/36983"},{"name":"oval:org.mitre.oval:def:6534","tags":["vdb-entry","signature","x_refsource_OVAL"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534"},{"name":"TA09-286B","tags":["third-party-advisory","x_refsource_CERT"],"url":"http://www.us-cert.gov/cas/techalerts/TA09-286B.html"},{"name":"1023007","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1023007"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.adobe.com/support/security/bulletins/apsb09-15.html"},{"name":"20091009 Adobe Acrobat and Acrobat Reader Remote Code Execution","tags":["third-party-advisory","x_refsource_ISS"],"url":"http://www.iss.net/threats/348.html"},{"name":"ADV-2009-2851","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2009/2851"},{"tags":["x_refsource_MISC"],"url":"http://isc.sans.org/diary.html?storyid=7300"},{"tags":["x_refsource_CONFIRM"],"url":"http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html"},{"name":"36600","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/36600"},{"name":"ADV-2009-2898","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2009/2898"},{"name":"adobe-reader-pdf-code-execution(53691)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/53691"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@adobe.com","ID":"CVE-2009-3459","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"36983","refsource":"SECUNIA","url":"http://secunia.com/advisories/36983"},{"name":"oval:org.mitre.oval:def:6534","refsource":"OVAL","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534"},{"name":"TA09-286B","refsource":"CERT","url":"http://www.us-cert.gov/cas/techalerts/TA09-286B.html"},{"name":"1023007","refsource":"SECTRACK","url":"http://securitytracker.com/id?1023007"},{"name":"http://www.adobe.com/support/security/bulletins/apsb09-15.html","refsource":"CONFIRM","url":"http://www.adobe.com/support/security/bulletins/apsb09-15.html"},{"name":"20091009 Adobe Acrobat and Acrobat Reader Remote Code Execution","refsource":"ISS","url":"http://www.iss.net/threats/348.html"},{"name":"ADV-2009-2851","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2009/2851"},{"name":"http://isc.sans.org/diary.html?storyid=7300","refsource":"MISC","url":"http://isc.sans.org/diary.html?storyid=7300"},{"name":"http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html","refsource":"CONFIRM","url":"http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html"},{"name":"36600","refsource":"BID","url":"http://www.securityfocus.com/bid/36600"},{"name":"ADV-2009-2898","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2009/2898"},{"name":"adobe-reader-pdf-code-execution(53691)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/53691"}]}}}},"cveMetadata":{"assignerOrgId":"078d4453-3bcd-4900-85e6-15281da43538","assignerShortName":"adobe","cveId":"CVE-2009-3459","datePublished":"2009-10-13T10:00:00.000Z","dateReserved":"2009-09-29T00:00:00.000Z","dateUpdated":"2026-05-21T03:55:27.999Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794090000,"cve":"CVE-2009-3459","description":"Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.","epss":{"date":"2026-11-12","epss":0.86531,"percentile":0.99743},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2009-3459","cwes":["CWE-119"],"dateAdded":"2026-05-20","dueDate":"2026-06-03","forensicTriage":"No","knownRansomwareCampaignUse":"Unknown","notes":"https://www.cisa.gov/news-events/alerts/2009/10/13/adobe-reader-and-acrobat-vulnerabilities ; https://web.archive.org/web/20120324170253/http://www.adobe.com/support/security/bulletins/apsb09-15.html#:~:text=CVE%2D2009%2D3459).-,NOTE%3A,-There%20are%20reports ; https://nvd.nist.gov/vuln/detail/CVE-2009-3459","product":"Acrobat and Reader","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","shortDescription":"Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.","vendorProject":"Adobe","vulnerabilityName":"Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability"},"kev_checked":1794522003,"products":"n/a n/a","references":["http://secunia.com/advisories/36983","https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534","http://www.us-cert.gov/cas/techalerts/TA09-286B.html","http://securitytracker.com/id?1023007","http://www.adobe.com/support/security/bulletins/apsb09-15.html","http://www.iss.net/threats/348.html","http://www.vupen.com/english/advisories/2009/2851","http://isc.sans.org/diary.html?storyid=7300","http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html","http://www.securityfocus.com/bid/36600","http://www.vupen.com/english/advisories/2009/2898","https://exchange.xforce.ibmcloud.com/vulnerabilities/53691","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3459"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","provider":"CISA-ADP","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[]}