10
CVE-2009-3953
- EPSS 90.51%
- Published 13.01.2010 19:30:00
- Last modified 09.04.2025 00:30:58
- Source psirt@adobe.com
- Teams watchlist Login
- Open Login
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.
Data is provided by the National Vulnerability Database (NVD)
Suse ≫ Linux Enterprise Debuginfo Version11 Update-
Suse ≫ Linux Enterprise Version10.0 Updatesp2
Suse ≫ Linux Enterprise Version10.0 Updatesp3
08.06.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog
Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability
VulnerabilityAdobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.
DescriptionApply updates per vendor instructions.
Required actions| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 90.51% | 0.996 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 10 | 10 | 10 |
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
CWE-787 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.