Adobe Reader CVE-2009-3459: 2009 Heap Overflow in KEV
A 2009 bug in Reader and Acrobat 7 through 9, product lines Adobe stopped supporting in 2013; anyone on a current Acrobat is unaffected, and any machine that still runs version 9 or older needs that install removed, not patched.
Must act: Anyone with Adobe Reader or Acrobat 9.x or older still installed, typically on legacy Windows machines, lab or industrial PCs, or old virtual machine images.
Can relax: Users of any supported Acrobat or Acrobat Reader release, including the Continuous track and Classic 2024, which this 2009 bug does not affect.
- Search software inventory for Adobe Reader or Acrobat with a major version of 9 or lower on Windows, macOS and Linux.
- Uninstall those versions and install a current Acrobat Reader or Acrobat release instead of applying the 2009 updates.
- If a legacy application truly needs an old Reader, isolate that machine from email, web browsing and untrusted PDFs.