CVE-2009-3953

adobe acrobat, suse linux enterprise debuginfo, opensuse

Published 13 Jan 2010 · updated 16 Jun 2026 · Analyzed

8.8 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 8 Jun 2022, with a remediation deadline of 22 Jun 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.

References

lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html · Mailing List, Third Party Advisory
osvdb.org/61690 · Broken Link
secunia.com/advisories/38138 · Broken Link
secunia.com/advisories/38215 · Broken Link
www.adobe.com/support/security/bulletins/apsb10-02.html · Not Applicable, Patch, Vendor Advisory
www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl · Third Party Advisory
www.redhat.com/support/errata/RHSA-2010-0060.html · Broken Link
www.securityfocus.com/bid/37758 · Broken Link, Third Party Advisory, VDB Entry
www.securitytracker.com/id?1023446 · Broken Link, Third Party Advisory, VDB Entry
www.us-cert.gov/cas/techalerts/TA10-013A.html · Third Party Advisory, US Government Resource
www.vupen.com/english/advisories/2010/0103 · Broken Link, Vendor Advisory
bugzilla.redhat.com/show_bug.cgi?id=554293 · Issue Tracking
exchange.xforce.ibmcloud.com/vulnerabilities/55551 · Third Party Advisory, VDB Entry
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242 · Broken Link
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3953 · US Government Resource