In CISA KEV8.8 High
CVE-2009-3459
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
AdobeAcrobat and Reader
Status
- Exploited in the wild
- In CISA KEV since 20 May
- Vendor fix available
Federal deadlineWed 3 Jun, 23:59 UTC
Passed 143 days ago
CISA KEV · added 20 May
Exploit probabilityEPSSchecked 22 Oct
87%probability of exploitation in the next 30 days
Higher than 100% of scored CVEs
SeverityCVSS
8.8High
Description NVD
Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October NOTE: some of these details are obtained from third party information.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 4 articles · 2 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 20 May · 18:02 UTC | CISA | CISA adds seven KEV flaws, including 2026 Microsoft Defender bugs |
| Wed 20 May · 19:34 UTC | CISA | CISA Warns of Active Exploits in Adobe PDF Flaw CVE‑2009‑3459 |
| Wed 20 May · 20:12 UTC | CISA | CISA Updates KEV Catalog with New Actively Exploited Flaws |
| Thu 21 May · 21:32 UTC | Security Affairs | CISA Adds Critical Flaws in Windows, Office, Defender to KEV List |
- CISA Adds Critical Flaws in Windows, Office, Defender to KEV ListSecurity Affairs · mentions it in passing
- CISA Updates KEV Catalog with New Actively Exploited FlawsCISA · official notice
- CISA Warns of Active Exploits in Adobe PDF Flaw CVE‑2009‑3459CISA · official notice
- CISA adds seven KEV flaws, including 2026 Microsoft Defender bugsCISA · first in our coverage · official notice · mentions it in passing