CVE-2009-3459
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
Description
CVE-2009-3459 is a high-severity heap-based buffer overflow vulnerability in Adobe Reader and Adobe Acrobat. A crafted PDF file triggers memory corruption when parsed, allowing a remote attacker to execute arbitrary code in the context of the user who opens the document. Because PDFs are universally exchanged via email and the web, malicious documents make this an effective vector for drive-by and social-engineering attacks. With a CVSS score of 8.8, an EPSS score of 88% (99.5th percentile), confirmed exploitation in the wild in October 2009, and a CISA KEV listing, CVE-2009-3459 remains a serious risk wherever outdated Adobe Reader or Acrobat versions are still in use.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | acrobat | >= 7.0, < 7.1.4; >= 8.0, < 8.1.7; >= 9.0, < 9.2 |
| adobe | acrobat reader | >= 7.0, < 7.1.4; >= 8.0, < 8.1.7; >= 9.0, < 9.2 |
References
- http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html(Broken Link, Vendor Advisory)
- http://isc.sans.org/diary.html?storyid=7300(Not Applicable)
- http://secunia.com/advisories/36983(Vendor Advisory)
- http://securitytracker.com/id?1023007(Broken Link)
- http://www.adobe.com/support/security/bulletins/apsb09-15.html(Patch, Vendor Advisory)
- http://www.iss.net/threats/348.html(Broken Link)
- http://www.securityfocus.com/bid/36600(Broken Link)
- http://www.us-cert.gov/cas/techalerts/TA09-286B.html(US Government Resource)
- http://www.vupen.com/english/advisories/2009/2851(Vendor Advisory)
- http://www.vupen.com/english/advisories/2009/2898(Vendor Advisory)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53691(Third Party Advisory, VDB Entry)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3459(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
In Adobe Reader and Acrobat, the flaw stems from improperly bounded operations during PDF parsing, allowing a crafted document to write outside the intended buffer and corrupt memory in a way that leads to arbitrary code execution.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-122: Heap-based Buffer Overflow
Specifically, the memory corruption is a heap-based buffer overflow: data from the crafted PDF overflows a heap-allocated buffer, corrupting adjacent heap structures and giving the attacker a path to control execution flow.
Learn more: CWE-122 — Heap-based Buffer Overflow
Impact Analysis
CVE-2009-3459 carries a CVSS 3.1 score of 8.8 (HIGH). It is remotely exploitable over the network with low attack complexity and requires no privileges, but it does require user interaction — the victim must open a crafted PDF — and on success it fully compromises the confidentiality, integrity, and availability of the affected system in the user's context. Because PDF documents are routinely opened from email attachments, downloads, and embedded web content, attackers can reliably deliver the malicious file through phishing or drive-by techniques. The EPSS score of 88% (99.5th percentile) reflects near-certain exploitation activity, and the CISA KEV listing confirms in-the-wild use, so organizations still running affected Reader or Acrobat versions face a high likelihood of compromise.
Exploit Maturity
CVE-2009-3459 was exploited in the wild in October 2009 and is listed on the CISA Known Exploited Vulnerabilities catalog, with an EPSS score of 88% (99.5th percentile) indicating near-certain exploitation activity. No exploit-tagged proof-of-concept appears in the NVD references — the primary source is the Adobe security bulletin APSB09-15 — but PDF-borne memory-corruption exploits of this era were rapidly incorporated into exploit kits and crimeware, and reliable techniques for heap overflows in Adobe Reader are well documented. Any environment still running vulnerable Reader or Acrobat builds should treat this as actively dangerous and patch immediately.
Remediation
- Apply updates immediately or remove the affected asset from the network as mandated by the CISA KEV deadline of 2026-06-03: upgrade Adobe Reader and Acrobat to a fixed version — 7.1.4 or later for the 7.x branch, 8.1.7 or later for 8.x, and 9.2 or later for 9.x — per Adobe bulletin APSB09-15.
- Because these are long-unsupported releases, prefer upgrading to a current, supported version of Adobe Reader/Acrobat (or a maintained PDF reader) rather than merely the minimum fixed build.
- As an interim mitigation, scan and filter inbound PDF attachments at email and web gateways, disable automatic PDF rendering in browsers, and advise users not to open untrusted documents.
- Monitor endpoints for signs of exploitation such as unexpected child processes spawned by the PDF reader and unusual network connections following document opens.
- As long-term hardening against heap-based buffer overflows, ensure exploit-mitigation features (DEP/ASLR) are enabled, keep document-handling software current, and consider sandboxed PDF readers that contain memory-corruption exploits.
Technical Details
CVE-2009-3459 is a heap-based buffer overflow (CWE-122), a specific form of improper memory-buffer operation (CWE-119), in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2. When the application parses a crafted PDF file, attacker-controlled data overflows a heap-allocated buffer and corrupts adjacent heap memory, which can be leveraged to hijack execution flow and run arbitrary code. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a network-deliverable, low-complexity attack requiring the victim to open the malicious document, after which the system is fully compromised in the user's context. Some details of the flaw were originally derived from third-party information, and it was observed exploited in the wild in October 2009.
Frequently Asked Questions
Is CVE-2009-3459 being actively exploited?
Yes. CVE-2009-3459 was exploited in the wild in October 2009 and is listed on the CISA Known Exploited Vulnerabilities catalog. Its EPSS score of 88% (99.5th percentile) indicates near-certain ongoing exploitation activity against unpatched installations.
What products are affected by CVE-2009-3459?
The vulnerability affects Adobe Reader and Adobe Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2. These are long-unsupported releases, so affected systems should be upgraded to a current supported version.
How do I fix CVE-2009-3459?
Upgrade Adobe Reader and Acrobat to at least 7.1.4, 8.1.7, or 9.2 per Adobe bulletin APSB09-15 — or, preferably, to a current supported release. As an interim measure, filter inbound PDFs and avoid opening untrusted documents.
How severe is CVE-2009-3459?
CVE-2009-3459 is rated HIGH with a CVSS 3.1 score of 8.8. A crafted PDF can trigger a heap-based buffer overflow leading to remote code execution in the user's context, and the flaw was confirmed exploited in the wild, making it a serious risk on outdated installations.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.