Adobe Reader CVE-2009-3459: 2009 Heap Overflow in KEV

What to do

1. Search software inventory for Adobe Reader or Acrobat with a major version of 9 or lower on Windows, macOS and Linux.
2. Uninstall those versions and install a current Acrobat Reader or Acrobat release instead of applying the 2009 updates.
3. If a legacy application truly needs an old Reader, isolate that machine from email, web browsing and untrusted PDFs.
4. Remove leftover Adobe Reader 9 packages from Linux hosts and old VM templates.

How to check if you are affected or compromised

• Treat any install of Reader or Acrobat 9.1.3 or older as exposed; no new indicators for this CVE have been published as of Oct 23, 2026.
• On legacy hosts that still run an old Reader, review EDR or process logs for AcroRd32.exe or Acrobat.exe spawning shells, script hosts or unsigned binaries.

What happened#

On October 8, 2009, Adobe's security team warned of a critical flaw in Adobe Reader and Acrobat 9.1.3 and earlier, CVE-2009-3459. It said the bug was "being exploited in the wild in limited targeted attacks" against Reader and Acrobat 9.1.3 on Windows. Adobe said DEP on Windows Vista blocked the exploit. Turning off JavaScript also stopped "this specific exploit," though Adobe warned a variant without JavaScript was possible. The SANS Internet Storm Center told readers not to count on disabled JavaScript. Adobe credited Chia-Ching Fang and Taiwan's Information and Communication Security Technology Center.

Five days later, on October 13, Adobe's quarterly update APSB09-15 fixed 29 CVEs. It describes this one as a heap overflow that could lead to code execution and notes "reports that this issue is being exploited in the wild, via limited, targeted attacks." US-CERT alert TA09-286B said the same day that the vulnerabilities were "being actively exploited." The CVE record says a crafted PDF triggers the overflow, "as exploited in the wild in October 2009."

On May 20, 2026, CISA added the CVE to the KEV catalog "based on evidence of active exploitation," with a June 3 deadline. The same batch held four other 2008 to 2010 bugs (CVE-2008-4250, CVE-2009-1537, CVE-2010-0249 and CVE-2010-0806) and two 2026 Microsoft Defender flaws. The KEV entry's notes point to the 2009 US-CERT alert and to the exploitation note in Adobe's 2009 bulletin. That suggests the listing records the 2009 attacks. CISA has not said whether it also saw new activity, and Security Affairs gave no reason either. As of Oct 23, 2026, no public source explains the timing. In April 2026, CISA listed another old Acrobat bug, CVE-2020-9715, in the same way.

Who is affected#

Reader and Acrobat 9.x before 9.2, 8.x before 8.1.7, and 7.x before 7.1.4. The fixed versions are 9.2, 8.1.7 and 7.1.4. NVD lists the same ranges, and CISA's enrichment scores it CVSS 3.1 8.8. All of these lines are long dead. Adobe says support for Reader 9.x and Acrobat 9.x ended on June 26, 2013, and that end of support covers security updates.

Do you really need to act?#

Almost certainly not. Any supported Acrobat or Reader, including the Continuous track and Classic 2024, is outside the affected range. Exposure means a 2009-era install still in use, such as a legacy Windows PC, a lab or industrial workstation, or an old VM template. If you find one, this CVE is the least of it. That install is also missing every security fix Adobe has shipped since. Remove it rather than patching it to 9.2.

What to do now#

1. Search inventory for old installs. On Windows: Get-ItemProperty HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -match 'Adobe (Reader|Acrobat)' | Select-Object DisplayName, DisplayVersion. Flag any version that starts with 9 or lower.
2. Uninstall those versions and install a current Acrobat Reader or Acrobat release.
3. If an old application truly needs an old Reader, keep that machine away from email, web browsing and untrusted PDFs.
4. On Linux, check for leftover Reader 9 packages with dpkg -l | grep -i acroread or rpm -qa | grep -i -E 'acroread|adobereader', and remove them.

How to tell if you were hit#

No new indicators have been published for this CVE. Treat any install at 9.1.3 or older as exposed. On legacy hosts that still run one, review EDR or process logs for AcroRd32.exe or Acrobat.exe launching shells, script hosts or unsigned binaries.

Timeline#

• Oct 8, 2009 — Adobe PSIRT warns of limited, targeted in-the-wild exploitation; SANS ISC reports it the same day.
• Oct 13, 2009 — Adobe releases APSB09-15; US-CERT issues TA09-286B; the CVE is published.
• Jun 26, 2013 — Support for Reader 9.x and Acrobat 9.x ends.
• May 20, 2026 — CISA adds the CVE to KEV.
• Jun 3, 2026 — KEV remediation deadline.

Vulnerability records

• CVE-2009-3459 · KEV 2026-05-20 · Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Adobe PSIRT — Adobe Reader and Acrobat issue (Oct 8, 2009, archived) web.archive.org
2. Adobe — APSB09-15: Security updates available for Adobe Reader and Acrobat (archived) web.archive.org
3. CVE record — CVE-2009-3459 cve.org
4. NVD — CVE-2009-3459 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2009-3459 cisa.gov
6. CISA — CISA Adds Seven Known Exploited Vulnerabilities to Catalog (May 20, 2026) cisa.gov
7. US-CERT — TA09-286B: Adobe Reader and Acrobat Vulnerabilities cisa.gov
8. Adobe — End of support: Reader 9 and Acrobat 9 (and earlier) (archived) web.archive.org
9. SANS Internet Storm Center — New Adobe Vulnerability Exploited in Targeted Attacks isc.sans.edu

Coverage and analysis

1. Security Affairs — U.S. CISA adds Microsoft and Adobe flaws to its Known Exploited Vulnerabilities catalog securityaffairs.com