Adobe · Acrobat and Reader
CVE-2009-4324
Adobe Acrobat and Reader Use-After-Free Vulnerability
CISA KEV record
- CISA date added
- 2022-06-08
- CISA due date
- 2022-06-22
- Known ransomware use
- Unknown
NVD risk context
7.8 HIGH
CVSS is a technical severity score. CISA’s KEV status remains the evidence that this vulnerability is known to be exploited.
Description
Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.
Required action
Apply updates per vendor instructions.
NVD reference index
Vendor and remediation references
NVD has tagged these sources as vendor advisories, patches, mitigations, or release notes.
- http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html ↗
- http://secunia.com/advisories/37690 ↗
- http://secunia.com/advisories/38138 ↗
- http://secunia.com/advisories/38215 ↗
- http://www.adobe.com/support/security/advisories/apsa09-07.html ↗
- http://www.vupen.com/english/advisories/2009/3518 ↗
Other NVD references (16)
- http://contagiodump.blogspot.com/2009/12/virustotal-httpwww.html ↗
- http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html ↗
- http://osvdb.org/60980 ↗
- http://www.adobe.com/support/security/bulletins/apsb10-02.html ↗
- http://www.kb.cert.org/vuls/id/508357 ↗
- http://www.metasploit.com/redmine/projects/framework/repository/revisions/7881/entry/modules/exploits/windows/fileformat/adobe_media_newplayer.rb ↗
- http://www.redhat.com/support/errata/RHSA-2010-0060.html ↗
- http://www.securityfocus.com/bid/37331 ↗
- http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20091214 ↗
- http://www.symantec.com/connect/blogs/zero-day-xmas-present ↗
- http://www.us-cert.gov/cas/techalerts/TA10-013A.html ↗
- http://www.vupen.com/english/advisories/2010/0103 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=547799 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54747 ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6795 ↗
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-4324 ↗
MITRE CWE context
CWE classification
Weaknesses in this category are related to improper management of system resources.
View official MITRE CWE details ↗NVD record timing
NVD record timeline
These dates describe NVD’s record, not CISA’s KEV addition or remediation due date.
- NVD published
- Dec 15, 2009, 02:30 AM UTC When NVD first published this CVE record.
- NVD last updated
- Jun 16, 2026, 11:13 PM UTC When NVD last changed its analysis or record data.
Advanced: view the technical CVSS vector
This standardized code is intended for security tools and technical analysts. The plain-language risk summary above explains its main points.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2009-4324