CVE-2009-4324

HIGH KEV

Adobe Reader/Acrobat <9.3-8.2 - RCE

Title source: llm

Description

Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.

Exploits (5)

exploitdb WORKING POC VERIFIED
by Metasploit · rubylocalwindows
https://www.exploit-db.com/exploits/16623
exploitdb WORKING POC VERIFIED
by Metasploit · rubylocalwindows
https://www.exploit-db.com/exploits/16503
exploitdb WORKING POC VERIFIED
by Ahmed Obied · pythonlocalwindows
https://www.exploit-db.com/exploits/10618
metasploit WORKING POC GOOD
by unknown, hdm, pusscat, jduck, jabra · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_media_newplayer.rb
metasploit WORKING POC GOOD
by unknown, hdm, pusscat, jduck · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/adobe_media_newplayer.rb

References (22)

... and 2 more

Scores

CVSS v3 7.8
EPSS 0.9286
EPSS Percentile 99.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CISA KEV 2022-06-08
VulnCheck KEV 2009-12-15
InTheWild.io 2018-10-30
ENISA EUVD EUVD-2009-4292
CWE
CWE-416
Status published
Products (6)
adobe/acrobat 8.0 - 8.2
adobe/acrobat_reader 8.0 - 8.2
opensuse/opensuse 11.1
opensuse/opensuse 11.2
suse/linux_enterprise 10.0 sp2 (2 CPE variants)
suse/linux_enterprise_debuginfo 11
Published Dec 15, 2009
KEV Added Jun 08, 2022
Tracked Since Feb 18, 2026