CVE-2009-3953
High 8.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.
Metrics
- CVSS 3.1
-
8.8 (HIGH)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 83% (percentile: 100) as of 1 November 2026
- CWE
- CWE-787
Affected products
adobe: acrobat; apple: mac os x; microsoft: windows; suse: linux enterprise debuginfo; opensuse: opensuse; suse: linux enterprise
References
- http://www.adobe.com/support/security/bulletins/apsb10-02.html Not ApplicablePatchVendor Advisory
- http://www.vupen.com/english/advisories/2010/0103 Broken LinkVendor Advisory
- http://www.adobe.com/support/security/bulletins/apsb10-02.html Not ApplicablePatchVendor Advisory
- http://www.vupen.com/english/advisories/2010/0103 Broken LinkVendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html Mailing ListThird Party Advisory
- http://osvdb.org/61690 Broken Link
- http://secunia.com/advisories/38138 Broken Link
- http://secunia.com/advisories/38215 Broken Link
- http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0060.html Broken Link