CVE-2009-3953

KEVAdobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability

Description

Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.

The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

PublishedJan 13, 2010

Last modifiedJun 16, 2026

Added to KEVJun 8, 2022

Remediation dueJun 22, 2022

References

lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.htmlMailing ListThird Party Advisory
osvdb.org/61690Broken Link
secunia.com/advisories/38138Broken Link
secunia.com/advisories/38215Broken Link
adobe.com/support/security/bulletins/apsb10-02.htmlNot ApplicablePatch
metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdeclThird Party Advisory
redhat.com/support/errata/RHSA-2010-0060.htmlBroken Link
securityfocus.com/bid/37758Broken LinkThird Party Advisory
securitytracker.com/id?1023446Broken LinkThird Party Advisory
us-cert.gov/cas/techalerts/TA10-013A.htmlThird Party AdvisoryUS Government Resource
vupen.com/english/advisories/2010/0103Broken LinkVendor Advisory
bugzilla.redhat.com/show_bug.cgi?id=554293Issue Tracking

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1588 days
CVSS: 8.8 HIGH
EPSS (30-day exploit probability): 83.2% · top 1% of all CVEs
Weakness: CWE-787
Attack vector: Network, remotely reachable

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.