{"id":"adobe-acrobat-reader-heap-overflow-may-2026","category":"patch","status":"closed","title":"Old Adobe Acrobat and Reader 2009 flaw CVE-2009-3459 added to CISA's exploited list; fixed since 2009","tldr":"CISA listed a 2009 Adobe Acrobat and Reader flaw (CVE-2009-3459) as exploited on 20 May 2026. It was fixed in 2009, in versions 7.1.4, 8.1.7 and 9.2. Anyone on a current, updated Acrobat or Reader is not affected; very old copies should be removed.","summary":"On 20 May 2026 the US cyber agency CISA added CVE-2009-3459 to its list of flaws known to be used in attacks. It is a heap-based buffer overflow in Adobe Acrobat and Reader: a booby-trapped PDF can corrupt the program's memory and let an attacker run their own code. The flaw is not new. It became public on 8 October 2009 and was published with an Adobe fix a few days later, and the record says it was exploited in the wild that October. The affected releases are Acrobat and Reader 7.x before 7.1.4, 8.x before 8.1.7 and 9.x before 9.2. Those fixed versions are more than a decade old, so anyone running a current, updated Acrobat or Reader is not exposed. The risk is limited to very old installations, such as neglected computers or legacy systems. CISA set a remediation due date of 3 June 2026 for US federal agencies and says it does not know whether ransomware groups have used the flaw. We could not read Adobe's bulletin directly, so the version details come from a vulnerability database that cites it.","action":"Make sure Adobe Acrobat and Reader are on a current version through the app's own update check, and remove any very old copy (version 9.1 or earlier) you no longer need. Nothing else is needed on an up-to-date computer.","product":"Adobe Acrobat and Reader (versions 7, 8 and 9)","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2009-3459"],"tags":["adobe","acrobat","reader","pdf","cisa-kev","buffer-overflow","legacy"],"affected":["Adobe Acrobat and Reader 7.x before 7.1.4","Adobe Acrobat and Reader 8.x before 8.1.7","Adobe Acrobat and Reader 9.x before 9.2"],"fixed":["7.1.4","8.1.7","9.2"],"matches":[{"platform":"windows","app":"Adobe Acrobat Reader","bundle":"","fixed":"9.2"},{"platform":"macos","app":"Adobe Acrobat Reader","bundle":"com.adobe.Reader","fixed":"9.2"}],"sources":[{"kind":"advisory","title":"Adobe Security Bulletin APSB09-15 (archived)","url":"https://web.archive.org/web/20120324170253/http://www.adobe.com/support/security/bulletins/apsb09-15.html","by":"Adobe","date":"2009-10-13"},{"kind":"research","title":"CVE-2009-3459 (GCVE-0-2009-3459)","url":"https://db.gcve.eu/vuln/CVE-2009-3459","by":"GCVE","date":"2026-05-20"}],"started":"2026-05-20","closed":"2026-05-20","created":"2026-11-03T21:44:11.358Z","updated":"2026-11-03T21:44:11.358Z","cve_notes":[{"cve":"CVE-2009-3459","name":"Heap buffer overflow in Adobe Acrobat and Reader PDFs","what":"A heap-based buffer overflow in how Acrobat and Reader 7, 8 and 9 handle PDF files, which a crafted PDF could use to run an attacker's code on the computer.","severity":"high","cvss":8.8}],"timeline":[{"at":"2026-05-20","added":"2026-11-03T21:41:32.717Z","kind":"cisa-added","text":"CISA added CVE-2009-3459 to its Known Exploited Vulnerabilities catalog, with a federal remediation due date of 2026-06-03. CISA lists its use in ransomware campaigns as unknown.","url":"https://db.gcve.eu/vuln/CVE-2009-3459","by":"GCVE","patch":null},{"at":"2009-10-13","added":"2026-11-03T21:41:32.717Z","kind":"new-fix","text":"The flaw was published with an Adobe update (bulletin APSB09-15). Fixed versions are Acrobat and Reader 7.1.4, 8.1.7 and 9.2.","url":"https://db.gcve.eu/vuln/CVE-2009-3459","by":"GCVE","patch":"patched"},{"at":"2009-10-08","added":"2026-11-03T21:41:32.717Z","kind":"disclosed","text":"The heap-based buffer overflow in Adobe Reader and Acrobat, CVE-2009-3459, became public. The record describes it as exploited in the wild in October 2009.","url":"https://db.gcve.eu/vuln/CVE-2009-3459","by":"GCVE","patch":null}],"url":"https://hard.fyi/live/adobe-acrobat-reader-heap-overflow-may-2026/","json":"https://hard.fyi/api/live?id=adobe-acrobat-reader-heap-overflow-may-2026"}