CVE-2009-3953

HIGH8.8

CISA KEV

Published 2010-01-13 · Updated 2026-06-16 · Source psirt@adobe.com

Summary

CVE-2009-3953 is a high-severity (CVSS 8.8) vulnerability in Adobe Acrobat and Reader. CISA added it to the Known Exploited Vulnerabilities catalog on June 8, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 22, 2022. CISA does not currently list it as used in ransomware campaigns. Adobe has 83 vulnerabilities in the KEV catalog, 11 of them linked to ransomware.

All 83 known-exploited Adobe vulnerabilities →

Description

The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-787CWE-787

CISA Known-Exploited Vulnerability

Product: Adobe — Acrobat and Reader

Name: Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability

Date added: 2022-06-08 · Due: 2022-06-22

Required action: Apply updates per vendor instructions.

References

View on NVD

More exploited Adobe vulnerabilities

Most recently added to CISA KEV

CVE-2026-48356
Commerce and Magento — Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
added 2026-10-27
CVE-2026-71362
Commerce and Magento — Adobe Commerce and Magento Incorrect Authorization Vulnerability
added 2026-09-24
CVE-2026-75650
Commerce and Magento — Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
added 2026-09-08
CVE-2026-48282
ColdFusion — Adobe ColdFusion Path Traversal Vulnerability
added 2026-07-07
CVE-2009-3459
Acrobat and Reader — Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
added 2026-05-20
CVE-2020-9715
Acrobat — Adobe Acrobat Use-After-Free Vulnerability
added 2026-04-13

View all →

Related CVEs

Same severity, most recent

CVE-2026-75590
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources and obtain sensitive information due to server-side request forgery. A protection that blocks requests to internal addresses can be bypassed, so the server could be made to contact internal services and return part of their responses.
2026-11-07 · score 7.2
CVE-2026-19128
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.
2026-11-07 · score 7.5
CVE-2026-19121
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.
2026-11-07 · score 8.3
CVE-2026-17411
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
2026-11-07 · score 7.6
CVE-2026-17407
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
2026-11-07 · score 8.5