CVE-2009-4324
HIGH KEVAdobe Reader/Acrobat <9.3-8.2 - RCE
Title source: llmDescription
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
Exploits (5)
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubylocalwindows
https://www.exploit-db.com/exploits/16623
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubylocalwindows
https://www.exploit-db.com/exploits/16503
exploitdb
WORKING POC
VERIFIED
by Ahmed Obied · pythonlocalwindows
https://www.exploit-db.com/exploits/10618
metasploit
WORKING POC
GOOD
by unknown, hdm, pusscat, jduck, jabra · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_media_newplayer.rb
metasploit
WORKING POC
GOOD
by unknown, hdm, pusscat, jduck · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/adobe_media_newplayer.rb
References (22)
... and 2 more
Scores
CVSS v3
7.8
EPSS
0.9286
EPSS Percentile
99.8%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CISA KEV
2022-06-08
VulnCheck KEV
2009-12-15
InTheWild.io
2018-10-30
ENISA EUVD
EUVD-2009-4292
CWE
CWE-416
Status
published
Products (6)
adobe/acrobat
8.0 - 8.2
adobe/acrobat_reader
8.0 - 8.2
opensuse/opensuse
11.1
opensuse/opensuse
11.2
suse/linux_enterprise
10.0 sp2 (2 CPE variants)
suse/linux_enterprise_debuginfo
11
Published
Dec 15, 2009
KEV Added
Jun 08, 2022
Tracked Since
Feb 18, 2026