CVE-2009-4324

HIGH KEV

Adobe Reader/Acrobat <9.3-8.2 - RCE

Title source: llm

Description

Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.

Exploits (5)

metasploit WORKING POC GOOD
by unknown, hdm, pusscat, jduck, jabra · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_media_newplayer.rb
metasploit WORKING POC GOOD
by unknown, hdm, pusscat, jduck · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/adobe_media_newplayer.rb
exploitdb WORKING POC VERIFIED
by Metasploit · rubylocalwindows
https://www.exploit-db.com/exploits/16503
exploitdb WORKING POC VERIFIED
by Metasploit · rubylocalwindows
https://www.exploit-db.com/exploits/16623
exploitdb WORKING POC VERIFIED
by Ahmed Obied · pythonlocalwindows
https://www.exploit-db.com/exploits/10618

References (22)

... and 2 more

Scores

CVSS v3 7.8
EPSS 0.9301
EPSS Percentile 99.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitation Intel

CISA KEV 2022-06-08
VulnCheck KEV 2009-12-15
InTheWild.io 2018-10-30
ENISA EUVD EUVD-2009-4292

Classification

CWE
CWE-416
Status draft

Affected Products (7)

adobe/acrobat < 8.2
adobe/acrobat_reader < 8.2
suse/linux_enterprise_debuginfo
opensuse/opensuse
opensuse/opensuse
suse/linux_enterprise
suse/linux_enterprise

Timeline

Published Dec 15, 2009
KEV Added Jun 08, 2022
Tracked Since Feb 18, 2026