CVE-2009-4324
HIGH KEVAdobe Reader/Acrobat <9.3-8.2 - RCE
Title source: llmDescription
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
Exploits (5)
metasploit
WORKING POC
GOOD
by unknown, hdm, pusscat, jduck, jabra · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_media_newplayer.rb
metasploit
WORKING POC
GOOD
by unknown, hdm, pusscat, jduck · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/adobe_media_newplayer.rb
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubylocalwindows
https://www.exploit-db.com/exploits/16503
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubylocalwindows
https://www.exploit-db.com/exploits/16623
exploitdb
WORKING POC
VERIFIED
by Ahmed Obied · pythonlocalwindows
https://www.exploit-db.com/exploits/10618
References (22)
... and 2 more
Scores
CVSS v3
7.8
EPSS
0.9301
EPSS Percentile
99.8%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitation Intel
CISA KEV
2022-06-08
VulnCheck KEV
2009-12-15
InTheWild.io
2018-10-30
ENISA EUVD
EUVD-2009-4292
Classification
CWE
CWE-416
Status
draft
Affected Products (7)
adobe/acrobat
< 8.2
adobe/acrobat_reader
< 8.2
suse/linux_enterprise_debuginfo
opensuse/opensuse
opensuse/opensuse
suse/linux_enterprise
suse/linux_enterprise
Timeline
Published
Dec 15, 2009
KEV Added
Jun 08, 2022
Tracked Since
Feb 18, 2026