AEGLIX vulnerability intelligence
CVE-2009-3953
HIGH · CVSS 8.8 · Analyzed
Published: 2010-01-13 · Updated: 2026-06-16 · Source: NVD
Vulnerability overview
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.
Severity and scoring
- CVSS score
- 8.8 · HIGH
- CVSS version
- 3.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-787
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Listed in CISA’s Known Exploited Vulnerabilities catalog.
- Affected product
- Adobe · Acrobat and Reader
- Added to catalog
- 2022-06-08
- Required action
- Apply updates per vendor instructions.
- CISA remediation due date
- 2022-06-22
CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*
From (inclusive): 7.0
Before (exclusive): 7.1.4
cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*
From (inclusive): 8.0
Before (exclusive): 8.2
cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*
From (inclusive): 9.0
Before (exclusive): 9.3
cpe:2.3:a:suse:linux_enterprise_debuginfo:11:-:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise:10.0:sp2:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise:10.0:sp3:*:*:*:*:*:*
These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.
Advisories and references
- http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
Mailing List · Third Party Advisory
- http://osvdb.org/61690
Broken Link
- http://secunia.com/advisories/38138
Broken Link
- http://secunia.com/advisories/38215
Broken Link
- http://www.adobe.com/support/security/bulletins/apsb10-02.html
Not Applicable · Patch · Vendor Advisory
- http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl
Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0060.html
Broken Link
- http://www.securityfocus.com/bid/37758
Broken Link · Third Party Advisory · VDB Entry
- http://www.securitytracker.com/id?1023446
Broken Link · Third Party Advisory · VDB Entry
- http://www.us-cert.gov/cas/techalerts/TA10-013A.html
Third Party Advisory · US Government Resource
- http://www.vupen.com/english/advisories/2010/0103
Broken Link · Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=554293
Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/55551
Third Party Advisory · VDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242
Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
Mailing List · Third Party Advisory
- http://osvdb.org/61690
Broken Link
- http://secunia.com/advisories/38138
Broken Link
- http://secunia.com/advisories/38215
Broken Link
- http://www.adobe.com/support/security/bulletins/apsb10-02.html
Not Applicable · Patch · Vendor Advisory
- http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl
Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0060.html
Broken Link
- http://www.securityfocus.com/bid/37758
Broken Link · Third Party Advisory · VDB Entry
- http://www.securitytracker.com/id?1023446
Broken Link · Third Party Advisory · VDB Entry
- http://www.us-cert.gov/cas/techalerts/TA10-013A.html
Third Party Advisory · US Government Resource
- http://www.vupen.com/english/advisories/2010/0103
Broken Link · Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=554293
Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/55551
Third Party Advisory · VDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242
Broken Link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3953
US Government Resource