CVE-2009-0927highunder attackCWE-121

CVE-2009-0927

Published · Updated

Follow this CVE+ Monitor Adobe Acrobat+ Monitor Reader Mobile

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 8.8epss 97%
from disclosure to weapon46 days
Published on NVDMar 19
1st PoC+46d
metasploit+5d
CISA KEV+4754d
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateAPT12🇨🇳 MITRE ATT&CK
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
10 products (20 components)
Red Hat Desktop version 3 Extras · Red Hat Desktop version 4 Extras · Red Hat Enterprise Linux AS version 3 Extras · Red Hat Enterprise Linux AS version 4 Extras · Red Hat Enterprise Linux Desktop Supplementary (v. 5) · and others 5
fix ↗
Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

Adobe Reader and Acrobat have a flaw where a specially crafted PDF file can cause the application to crash or allow an attacker to run malicious code on your computer. This happens when the software improperly handles certain commands.

Technical detail

Stack-based buffer overflow in the Collab object's getIcon method in Adobe Reader/Acrobat 9.x, 8.x, and 7.x allows remote code execution via a malformed PDF. The vulnerability requires the victim to open a crafted PDF file; successful exploitation results in arbitrary code execution with user privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to execute arbitrary code via a crafted argument to the getIcon method of a Collab object, a different vulnerability than CVE-2009-0658.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.