Actively exploited in the wild
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
Adobe - Acrobat and Reader · Listed in the CISA KEV since 2026-05-20. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2009-3459
HighCVSS 8.8KEVSummary
A heap-based buffer overflow in Adobe Reader and Acrobat allows remote attackers to execute arbitrary code via a crafted PDF file. This affects versions 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2.
Risk Assessment
Attackers can exploit this vulnerability to execute remote code, potentially compromising user systems. This issue was exploited in the wild in October 2009.
Recommendation
It is recommended to update Adobe Reader and Acrobat to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Adobe Reader i Acrobat
See all- CVE-2015-3060High
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors.
- CVE-2015-3059High
Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
- CVE-2014-8460High
A heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
- CVE-2014-8458High
Adobe Reader and Acrobat versions 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service through unspecified vectors. This is a different vulnerability than CVE-2014-8445, CVE-2014-8446, CVE-2014-8447, CVE-2014-8456, CVE-2014-8459, CVE-2014-8461, and CVE-2014-9158.
- CVE-2014-0565High
Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
- CVE-2014-0560High
Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
Original NVD description (English source)
Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS