Old Adobe Acrobat and Reader 2009 flaw CVE-2009-3459 added to CISA's exploited list; fixed since 2009
CISA listed a 2009 Adobe Acrobat and Reader flaw (CVE-2009-3459) as exploited on 20 May 2026. It was fixed in 2009, in versions 7.1.4, 8.1.7 and 9.2. Anyone on a current, updated Acrobat or Reader is not affected; very old copies should be removed.
Make sure Adobe Acrobat and Reader are on a current version through the app's own update check, and remove any very old copy (version 9.1 or earlier) you no longer need. Nothing else is needed on an up-to-date computer.
- Adobe Acrobat Readerfixed in 9.2 and later
- Adobe Acrobat Readerfixed in 9.2 and later
What’s happening
On 20 May 2026 the US cyber agency CISA added CVE-2009-3459 to its list of flaws known to be used in attacks. It is a heap-based buffer overflow in Adobe Acrobat and Reader: a booby-trapped PDF can corrupt the program's memory and let an attacker run their own code. The flaw is not new. It became public on 8 October 2009 and was published with an Adobe fix a few days later, and the record says it was exploited in the wild that October. The affected releases are Acrobat and Reader 7.x before 7.1.4, 8.x before 8.1.7 and 9.x before 9.2. Those fixed versions are more than a decade old, so anyone running a current, updated Acrobat or Reader is not exposed. The risk is limited to very old installations, such as neglected computers or legacy systems. CISA set a remediation due date of 3 June 2026 for US federal agencies and says it does not know whether ransomware groups have used the flaw. We could not read Adobe's bulletin directly, so the version details come from a vulnerability database that cites it.
- What
- Flaw
- Affects
- Adobe Acrobat and Reader (versions 7, 8 and 9)
- Affected
- Adobe Acrobat and Reader 7.x before 7.1.4
Adobe Acrobat and Reader 8.x before 8.1.7
Adobe Acrobat and Reader 9.x before 9.2 - Fixed in
- 7.1.4
8.1.7
9.2 - Since
- 20 May 2026
- Closed
- 20 May 2026
Timeline
- CISA added
CISA added CVE-2009-3459 to its Known Exploited Vulnerabilities catalog, with a federal remediation due date of 2026-06-03. CISA lists its use in ransomware campaigns as unknown.
- New fixFixed
The flaw was published with an Adobe update (bulletin APSB09-15). Fixed versions are Acrobat and Reader 7.1.4, 8.1.7 and 9.2.
- Made public
The heap-based buffer overflow in Adobe Reader and Acrobat, CVE-2009-3459, became public. The record describes it as exploited in the wild in October 2009.
Sources
- Adobe Security Bulletin APSB09-15 (archived)Adobe · 13 Oct 2009
- CVE-2009-3459 (GCVE-0-2009-3459)GCVE · 20 May 2026