CVE-2009-3459
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
Published Oct 13, 2009 · updated Jun 16, 2026 · Adobe Acrobat and Reader
Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2009 · Catalog
Detected
Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.
May 20, 2026 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 3, 2026 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date Jun 3, 2026
Affected
- cpe adobe/acrobatversion unspecified
- cpe adobe/acrobat readerversion unspecified
- vendor Adobe Acrobat and Readerversion unspecified
Sources
- CISA KEVCVE-2009-3459
Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.
cisa.gov - CVE.orgCVE-2009-3459
Official CVE identifier
cve.org - FIRST EPSSCVE-2009-3459
30-day exploitation probability 86.6%
first.org - Exploit Database16546
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database16652
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_windows/browser/adobe_flatedecode_predictor02
Public module reference (good). Module source is not copied into this catalog.
rapid7.com - Metasploit Modulesexploit_windows/fileformat/adobe_flatedecode_predictor02
Public module reference (good). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2009-3459
Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these de
nvd.nist.gov