CVE-2009-4324

KEVAdobe Acrobat and Reader Use-After-Free Vulnerability

Description

Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.

Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.

CVSS 3.1 vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

PublishedDec 15, 2009

Last modifiedJun 16, 2026

Added to KEVJun 8, 2022

Remediation dueJun 22, 2022

References

blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.htmlBroken LinkVendor Advisory
contagiodump.blogspot.com/2009/12/virustotal-httpwww.htmlExploitThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.htmlMailing ListThird Party Advisory
osvdb.org/60980Broken Link
secunia.com/advisories/37690Broken LinkVendor Advisory
secunia.com/advisories/38138Broken LinkVendor Advisory
secunia.com/advisories/38215Broken LinkVendor Advisory
adobe.com/support/security/advisories/apsa09-07.htmlVendor Advisory
adobe.com/support/security/bulletins/apsb10-02.htmlNot Applicable
kb.cert.org/vuls/id/508357Third Party AdvisoryUS Government Resource
metasploit.com/redmine/projects/framework/repository/revisions/7881/entry/modules/exploits/windows/fileformat/adobe_media_newplayer.rbBroken Link
redhat.com/support/errata/RHSA-2010-0060.htmlBroken Link

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1588 days
CVSS: 7.8 HIGH
EPSS (30-day exploit probability): 81.9% · top 1% of all CVEs
Weakness: CWE-416

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.