CVE-2009-3459: adobe acrobat +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2009-3459

CVSS 8.8 · High KEV · sudah dieksploitasi EPSS 86,6%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada adobe acrobat, adobe acrobat reader. Skor CVSS 3.1 8.8 (High) menurut CISA ADP. Masuk katalog KEV CISA pada 20 Mei 2026, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.

Rincian

Terbit di NVD: 13 Oktober 2009
Terakhir diubah: 16 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.8 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-122: Heap-based Buffer Overflow
EPSS (30 hari): 86,6% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
Masuk KEV: 20 Mei 2026
Tenggat CISA: 3 Juni 2026 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
adobe	acrobat	Versi 7.0 hingga sebelum 7.1.4
adobe	acrobat	Versi 8.0 hingga sebelum 8.1.7
adobe	acrobat	Versi 9.0 hingga sebelum 9.2
adobe	acrobat reader	Versi 7.0 hingga sebelum 7.1.4
adobe	acrobat reader	Versi 8.0 hingga sebelum 8.1.7
adobe	acrobat reader	Versi 9.0 hingga sebelum 9.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html broken link · advisory vendor
http://secunia.com/advisories/36983 advisory vendor
http://www.adobe.com/support/security/bulletins/apsb09-15.html patch · advisory vendor
http://www.vupen.com/english/advisories/2009/2851 advisory vendor
http://www.vupen.com/english/advisories/2009/2898 advisory vendor
http://www.us-cert.gov/cas/techalerts/TA09-286B.html pemerintah AS
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3459 pemerintah AS
https://exchange.xforce.ibmcloud.com/vulnerabilities/53691 advisory pihak ketiga · vdb entry
http://isc.sans.org/diary.html?storyid=7300 not applicable
http://securitytracker.com/id?1023007 broken link
http://www.iss.net/threats/348.html broken link
http://www.securityfocus.com/bid/36600 broken link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534 broken link

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.