Adobe Reader/Acrobat RCE exploited (CVE-2009-3459)
CVE-2009-3459
CVE-2009-3459: Heap-based buffer overflow in Adobe Reader 7.x/8.x/9.x leads to remote code execution via crafted PDF. Actively exploited. Update to 9.2 or later.
Actively exploited in the wild - CVE-2009-3459 is a critical heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 that allows remote attackers to execute arbitrary code via a crafted PDF file. Patches were released in October 2009; apply immediately if not already deployed.
Overview
CVE-2009-3459 is a critical heap-based buffer overflow vulnerability in Adobe Reader and Acrobat. The flaw triggers memory corruption when a specially crafted PDF file is opened, enabling an attacker to execute arbitrary code on the victim’s system. The vulnerability is remotely exploitable over the network with no authentication required, though user interaction is needed to open the malicious PDF.
This vulnerability was actively exploited in the wild in October 2009, and due to the sustained high EPSS probability of exploitation (87.0%), any unpatched installations remain at severe risk.
Impact
A successful exploit grants the attacker the ability to execute code with the privileges of the victim’s user account. Given the widespread deployment of PDF readers in enterprise environments, an attacker could use this vulnerability to deliver malware or gain an initial foothold on a network.
Severity: CRITICAL (CVSS 9.3)
Affected Products
- Adobe Reader and Acrobat 7.x before 7.1.4
- Adobe Reader and Acrobat 8.x before 8.1.7
- Adobe Reader and Acrobat 9.x before 9.2
Remediation
Patch immediately by upgrading to the following fixed versions:
- Adobe Reader and Acrobat 9.2 or later
- Adobe Reader and Acrobat 8.1.7 or later
- Adobe Reader and Acrobat 7.1.4 or later
If upgrading is not immediately possible, disable PDF handling in the browser or use content security gateways to inspect PDF files for suspicious structures. For further details, see the Adobe Security Advisory.
For data breach reports, visit our breach reports section; stay updated on vulnerabilities with our security news.
Security Insight
CVE-2009-3459 underscores the persistent risk posed by legacy file-format parsing vulnerabilities. Even though the patch is over a decade old, the high EPSS score indicates attackers continue to target unpatched systems, often in environments with outdated document collaboration tools. Many organizations still run legacy Adobe Reader versions on isolated endpoints; these represent a silent but critical risk. For CISOs, this case reinforces that multi-year patch cycles can leave a window open for adversaries using known exploit chains.
Further Reading
Never miss a critical vulnerability
Get real-time security alerts delivered to your preferred platform.
Metasploit Modules
Weaponized exploit code — authorized use only
The Metasploit Framework modules below are production-ready exploit code maintained by Rapid7. Unlike random GitHub PoCs, these are vetted by Metasploit maintainers and integrated into a point-and-click exploitation framework used by red teams worldwide. The presence of an MSF module means this CVE is trivially exploitable at scale — patch immediately.
Authorized use only. Run only against systems you own or have explicit written permission to test. Using exploit code against systems you do not own is illegal in most jurisdictions and violates Yazoul's terms of use.
| Module | Source |
|---|---|
exploit/windows/browser/adobe_flatedecode_predictor02 | View source |
exploit/windows/fileformat/adobe_flatedecode_predictor02 | View source |
2 Metasploit modules indexed for this CVE. Source: rapid7/metasploit-framework.
Exploit-DB Entries
Curated public exploit code — authorized use only
The entries below are human-reviewed exploit code hosted on Exploit-DB by Offensive Security. Lower volume than random GitHub PoCs but higher signal: every entry is curated, many are tagged "verified" by the maintainers. Treat as production-ready exploit code.
Authorized use only. Run only against systems you own or have explicit written permission to test. Using exploit code against systems you do not own is illegal in most jurisdictions and violates Yazoul's terms of use.
| EDB-ID | Title | Status |
|---|---|---|
| EDB-16546 | Adobe - FlateDecode Stream Predictor 02 Integer Overflow (Metasploit) (1) | verified |
| EDB-16652 | Adobe - FlateDecode Stream Predictor 02 Integer Overflow (Metasploit) (2) | verified |
2 Exploit-DB entries indexed for this CVE. Source: Exploit-DB.
Related Advisories
A vulnerability has been found in Tenda A15 15.13.07.13. The impacted element is the function UploadCfg of the file /cgi-bin/UploadCfg. The manipulation of the argument File leads to stack-based buffe...
A flaw has been found in Wavlink NU516U1 251208. This affects the function sub_401A10 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to out-of-bounds write. T...
A security flaw has been discovered in UTT HiPER 1250GW up to 3.2.7-210907-180535. The impacted element is an unknown function of the file /goform/formRemoteControl. The manipulation of the argument P...
A flaw has been found in Tenda FH451 1.0.0.9. This affects the function formWrlExtraSet of the file /goform/WrlExtraSet. This manipulation of the argument GO causes stack-based buffer overflow. The at...