CVE-2009-3953
Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability
Published Jan 13, 2010 · updated Jun 16, 2026 · adobe acrobat
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.
Timeline
Detection, updates, and resolution for this record.
Jan 13, 2010 · Catalog
Detected
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.
Jun 8, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jun 22, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.
Required action
Apply updates per vendor instructions.
CISA due date Jun 22, 2022
Affected
- cpe adobe/acrobatversion unspecified
- cpe opensuse/opensuse11.1
- cpe opensuse/opensuse11.2
- cpe suse/linux enterprise10.0
- cpe suse/linux enterprise debuginfo11
- vendor Adobe Acrobat and Readerversion unspecified
Sources
- CISA KEVCVE-2009-3953
Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.
cisa.gov - CVE.orgCVE-2009-3953
Official CVE identifier
cve.org - FIRST EPSSCVE-2009-3953
30-day exploitation probability 83.2%
first.org - Exploit Database16622
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_windows/fileformat/adobe_u3d_meshdecl
Public module reference (good). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2009-3953
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary
nvd.nist.gov