{"id":"CVE-2009-4324","published":"2009-12-15T02:30:00Z","modified":"2026-06-16T23:13:26Z","title":"Adobe Acrobat and Reader Use-After-Free Vulnerability","vendor":"Adobe","product":"Acrobat and Reader","tier":"core","eol":{"product":"Adobe Reader/Acrobat 9","since":"2013-06-26","note":"No security updates; remove it."},"description":{"text":"Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.","provenance":"source","from":"NVD"},"summary":{"text":"Adobe Acrobat and Reader contain a use-after-free flaw in the Doc.media.newPlayer method within the Multimedia.api component, affecting Reader and Acrobat 9.x before 9.3 and 8.x before 8.2 on Windows and Mac OS X. An attacker can execute arbitrary code by supplying a crafted PDF file that uses ZLib compressed streams, and the attack requires a user to open that file.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:47Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.8188,"percentile":0.99649,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2022-06-08","dueDate":"2022-06-22","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2009-4324","provenance":"source"},"vulncheckKev":{"dateAdded":"2009-12-15","exploitedFirstSeen":"2009-12-15","ransomware":false,"evidence":[{"url":"https://www.cve.org/CVERecord?id=CVE-2009-4324","date":"2009-12-15"},{"url":"https://blog.talosintelligence.com/acrobat-javascript-blacklist-framework/","date":"2010-01-20"},{"url":"https://citizenlab.ca/wp-content/uploads/2017/05/shadows-in-the-cloud.pdf","date":"2010-04-06"},{"url":"https://www.virusbulletin.com/virusbulletin/2010/05/exploit-kit-explosion-part-two-vectors-attack/","date":"2010-05-01"},{"url":"https://securelist.com/end-of-the-line-for-the-bredolab-botnet/36335/","date":"2010-12-10"},{"url":"https://web.archive.org/web/20120907091804/http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the_taidoor_campaign.pdf","date":"2012-01-01"},{"url":"https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf","date":"2012-01-01"},{"url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/wham-bam-the-cutwailblackhole-combo/","date":"2012-07-02"},{"url":"https://users.ece.cmu.edu/~tdumitra/public_documents/bilge12_zero_day.pdf","date":"2012-10-18"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-06-08"}],"evidenceTotal":10,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Nov 1, 2026","url":"https://otx.alienvault.com/pulse/6ae6007740c10de9f3c0173d","created":"2026-10-31"},{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"}],"provenance":"machine"},"cwes":[{"id":"CWE-416","name":"Use After Free"},{"id":"CWE-399","name":null}],"references":[{"url":"http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html","tags":["Broken Link","Vendor Advisory"]},{"url":"http://contagiodump.blogspot.com/2009/12/virustotal-httpwww.html","tags":["Exploit","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://osvdb.org/60980","tags":["Broken Link"]},{"url":"http://secunia.com/advisories/37690","tags":["Broken Link","Vendor Advisory"]},{"url":"http://secunia.com/advisories/38138","tags":["Broken Link","Vendor Advisory"]},{"url":"http://secunia.com/advisories/38215","tags":["Broken Link","Vendor Advisory"]},{"url":"http://www.adobe.com/support/security/advisories/apsa09-07.html","tags":["Vendor Advisory"]},{"url":"http://www.adobe.com/support/security/bulletins/apsb10-02.html","tags":["Not Applicable"]},{"url":"http://www.kb.cert.org/vuls/id/508357","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.metasploit.com/redmine/projects/framework/repository/revisions/7881/entry/modules/exploits/windows/fileformat/adobe_media_newplayer.rb","tags":["Broken Link"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0060.html","tags":["Broken Link"]},{"url":"http://www.securityfocus.com/bid/37331","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20091214","tags":["Broken Link"]},{"url":"http://www.symantec.com/connect/blogs/zero-day-xmas-present","tags":["Broken Link"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA10-013A.html","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.vupen.com/english/advisories/2009/3518","tags":["Broken Link","Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/0103","tags":["Broken Link"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=547799","tags":["Issue Tracking"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/54747","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6795","tags":["Broken Link"]},{"url":"http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html","tags":["Broken Link","Vendor Advisory"]},{"url":"http://contagiodump.blogspot.com/2009/12/virustotal-httpwww.html","tags":["Exploit","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://osvdb.org/60980","tags":["Broken Link"]},{"url":"http://secunia.com/advisories/37690","tags":["Broken Link","Vendor Advisory"]},{"url":"http://secunia.com/advisories/38138","tags":["Broken Link","Vendor Advisory"]},{"url":"http://secunia.com/advisories/38215","tags":["Broken Link","Vendor Advisory"]},{"url":"http://www.adobe.com/support/security/advisories/apsa09-07.html","tags":["Vendor Advisory"]},{"url":"http://www.adobe.com/support/security/bulletins/apsb10-02.html","tags":["Not Applicable"]},{"url":"http://www.kb.cert.org/vuls/id/508357","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.metasploit.com/redmine/projects/framework/repository/revisions/7881/entry/modules/exploits/windows/fileformat/adobe_media_newplayer.rb","tags":["Broken Link"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0060.html","tags":["Broken Link"]},{"url":"http://www.securityfocus.com/bid/37331","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20091214","tags":["Broken Link"]},{"url":"http://www.symantec.com/connect/blogs/zero-day-xmas-present","tags":["Broken Link"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA10-013A.html","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.vupen.com/english/advisories/2009/3518","tags":["Broken Link","Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/0103","tags":["Broken Link"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=547799","tags":["Issue Tracking"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/54747","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6795","tags":["Broken Link"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-4324","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev","ctid-cve"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Use After Free; CTID attack_to_cve (Phase 1)","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited by having the user open a maliciously-crafted pdf file. In the wild, this has been observed to result in a malicious actor installing a custom executable on the victim's machine, and establishing communications.","confidence":"high"},{"id":"T1071.001","name":"Web Protocols","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Use After Free","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited by having the user open a maliciously-crafted pdf file. In the wild, this has been observed to result in a malicious actor installing a custom executable on the victim's machine, and establishing communications.","confidence":"high"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2009-4292","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-4292","exploited":true,"exploitedSince":"2022-06-08","provenance":"source"},"exploits":[{"id":10618,"url":"https://www.exploit-db.com/exploits/10618","title":"Adobe Reader / Acrobat - '.PDF' File Overflow","type":"local","platform":"windows","date":"2009-12-23","verified":true,"provenance":"source"},{"id":16503,"url":"https://www.exploit-db.com/exploits/16503","title":"Adobe - 'Doc.media.newPlayer' Use-After-Free (Metasploit) (1)","type":"local","platform":"windows","date":"2010-04-30","verified":true,"provenance":"source"},{"id":16623,"url":"https://www.exploit-db.com/exploits/16623","title":"Adobe - 'Doc.media.newPlayer' Use-After-Free (Metasploit) (2)","type":"local","platform":"windows","date":"2010-09-25","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":3,"earliest":"2009-12-23"},"metasploit":[{"name":"Adobe Doc.media.newPlayer Use After Free Vulnerability","module":"exploit/windows/browser/adobe_media_newplayer","type":"exploit","disclosureDate":"2009-12-14","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_media_newplayer.rb"},{"name":"Adobe Doc.media.newPlayer Use After Free Vulnerability","module":"exploit/windows/fileformat/adobe_media_newplayer","type":"exploit","disclosureDate":"2009-12-14","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/adobe_media_newplayer.rb"}],"first":{"date":"2009-12-14","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_media_newplayer.rb"},"provenance":"source"},"exploitRefs":["http://contagiodump.blogspot.com/2009/12/virustotal-httpwww.html"],"flow":[{"stage":"exploitation","techniques":["T1204.002"],"provenance":"source"},{"stage":"primary","techniques":["T1071.001"],"provenance":"source"},{"stage":"related","techniques":["T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2009-12-14","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2009-12-23","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_media_newplayer.rb","provenance":"source"},{"date":"2009-12-15","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2009-4324","provenance":"source"},{"date":"2009-12-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cve.org/CVERecord?id=CVE-2009-4324","provenance":"source"},{"date":"2022-06-08","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-06-08","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-4292","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":4558},"priority":{"score":53.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 6165 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9965"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 3 Exploit-DB entries; 2 Metasploit modules"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":-15.0,"detail":"No patches exist; remove or isolate it"}]},"lineage":{"familyId":"fam-class-adobe-acrobat-reader-cwe-416"}}