[KEV] CVE-2009-3459 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2009-3459 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2009-3459 is a heap-based buffer overflow vulnerability in Adobe Acrobat and Reader that can be triggered by a remote attacker through a specially crafted PDF file.

Technical Detail

The flaw resides in how Adobe Acrobat and Reader process certain PDF file structures, where malformed content causes a heap-based buffer overflow resulting in memory corruption. An attacker can exploit this by delivering a crafted PDF to a target user, typically via email attachment or a malicious web page, requiring only that the file be opened in a vulnerable version of the software. Successful exploitation results in remote code execution (RCE) in the context of the user running the application, which on Windows systems with standard user configurations could still allow significant access to user data and system resources.

Exploitation Status

The exploit maturity for this vulnerability is rated Operational, meaning functional exploit code exists and has been used in real-world attack scenarios. CISA has confirmed active exploitation in the wild, with this vulnerability added to the Known Exploited Vulnerabilities (KEV) catalog on May 20, 2026. Despite the age of this CVE, its presence in the KEV catalog indicates continued or renewed exploitation activity against unpatched or legacy deployments.

Who Is Targeting This

No specific threat actor attribution is confirmed at this time. The absence of attribution data does not reduce risk, particularly given the KEV listing, which indicates observed exploitation by unspecified actors. Organizations running legacy versions of Adobe Acrobat or Reader should treat this as an active threat regardless of attribution.

What To Do

Organizations should prioritize patching all instances of Adobe Acrobat and Reader to a currently supported and fully patched version immediately. Per CISA's Known Exploited Vulnerabilities catalog, federal agencies operating under BOD 22-01 are required to remediate this vulnerability by the deadline associated with the May 20, 2026 KEV listing. Where immediate patching is not possible, organizations should consider disabling PDF rendering in browser plugins, restricting PDF file execution to sandboxed environments, and applying email gateway controls to block unsolicited PDF attachments. Detection efforts should focus on monitoring for anomalous process spawning from Acrobat or Reader processes, which is a common indicator of successful exploitation via malicious PDF delivery.