CVE-2009-3958 [Critical] | Memory Corruption in Acrobat

CVE-2009-3958 is rated High Exploit Risk (84.6/100): CVSS Critical severity, with high exploitation likelihood (EPSS 52.59%, 99th percentile). 1 public exploit reference(s) are indexed (Exploit-DB). Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

EDB-ID	Source	Kind	Published	Link
11172	exploit_db	edb	2010-01-17	Exploit-DB ↗

EDB-ID

Source

Kind

Published

Link

11172

exploit_db

edb

2010-01-17

Exploit-DB ↗

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	65.35%	52.59%	-12.76%
2	2025-06-10	66.23%	65.35%	-0.89%
3	2025-03-30	—	66.23%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

65.35%

52.59%

-12.76%

2025-06-10

66.23%

65.35%

-0.89%

2025-03-30

—

66.23%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
10.0	2.0	HIGH	`AV:N/AC:L/Au:N/C:C/I:C/A:C` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:L) Exploitation conditions are straightforward and predictable. Authentication (AU:N) No authentication is required. Confidentiality impact (C:C) Complete confidentiality impact. Integrity impact (I:C) Complete integrity impact. Availability impact (A:C) Complete availability impact.	10.0	10.0	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

10.0

2.0

HIGH

AV:N/AC:L/Au:N/C:C/I:C/A:C Click to expand

Access vector (AV:N): Can be exploited remotely over network reachability.
Access complexity (AC:L): Exploitation conditions are straightforward and predictable.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:C): Complete confidentiality impact.
Integrity impact (I:C): Complete integrity impact.
Availability impact (A:C): Complete availability impact.

10.0

[email protected]

OS Trackers for CVE-2009-3958

vendor	priority	summary	link
`redhat`	critical	—	https://access.redhat.com/security/cve/CVE-2009-3958

vendor

priority

summary

link

redhat

critical

—

https://access.redhat.com/security/cve/CVE-2009-3958

NVD evaluator notes for CVE-2009-3958

Impact: Per: http://www.adobe.com/support/security/bulletins/apsb10-02.html Affected software versions Adobe Reader 9.2 and earlier versions for Windows, Macintosh, and UNIX Adobe Acrobat 9.2 and earlier versions for Windows and Macintosh

Comment: Per: http://www.adobe.com/support/security/bulletins/apsb10-02.html a buffer overflow vulnerability in the Download Manager that could lead to code execution (CVE-2009-3958).

Affected software / configurations for CVE-2009-3958

Vendor	Product	Version	Raw CPE
adobe	acrobat	<= 9.2	cpe:2.3:a:adobe:acrobat::::::::
adobe	acrobat	3.0	cpe:2.3:a:adobe:acrobat:3.0:::::::*
adobe	acrobat	3.1	cpe:2.3:a:adobe:acrobat:3.1:::::::*
adobe	acrobat	4.0	cpe:2.3:a:adobe:acrobat:4.0:::::::*
adobe	acrobat	4.0.5	cpe:2.3:a:adobe:acrobat:4.0.5:::::::*
adobe	acrobat	4.0.5a	cpe:2.3:a:adobe:acrobat:4.0.5a:::::::*
adobe	acrobat	4.0.5c	cpe:2.3:a:adobe:acrobat:4.0.5c:::::::*
adobe	acrobat	5.0	cpe:2.3:a:adobe:acrobat:5.0:::::::*
adobe	acrobat	5.0.5	cpe:2.3:a:adobe:acrobat:5.0.5:::::::*
adobe	acrobat	5.0.6	cpe:2.3:a:adobe:acrobat:5.0.6:::::::*
adobe	acrobat	5.0.10	cpe:2.3:a:adobe:acrobat:5.0.10:::::::*
adobe	acrobat	6.0	cpe:2.3:a:adobe:acrobat:6.0:::::::*
adobe	acrobat	6.0.1	cpe:2.3:a:adobe:acrobat:6.0.1:::::::*
adobe	acrobat	6.0.2	cpe:2.3:a:adobe:acrobat:6.0.2:::::::*
adobe	acrobat	6.0.3	cpe:2.3:a:adobe:acrobat:6.0.3:::::::*
adobe	acrobat	6.0.4	cpe:2.3:a:adobe:acrobat:6.0.4:::::::*
adobe	acrobat	6.0.5	cpe:2.3:a:adobe:acrobat:6.0.5:::::::*
adobe	acrobat	6.0.6	cpe:2.3:a:adobe:acrobat:6.0.6:::::::*
adobe	acrobat	7.0	cpe:2.3:a:adobe:acrobat:7.0:::::::*
adobe	acrobat	7.0.1	cpe:2.3:a:adobe:acrobat:7.0.1:::::::*
adobe	acrobat	7.0.2	cpe:2.3:a:adobe:acrobat:7.0.2:::::::*
adobe	acrobat	7.0.3	cpe:2.3:a:adobe:acrobat:7.0.3:::::::*
adobe	acrobat	7.0.4	cpe:2.3:a:adobe:acrobat:7.0.4:::::::*
adobe	acrobat	7.0.5	cpe:2.3:a:adobe:acrobat:7.0.5:::::::*
adobe	acrobat	7.0.6	cpe:2.3:a:adobe:acrobat:7.0.6:::::::*
adobe	acrobat	7.0.7	cpe:2.3:a:adobe:acrobat:7.0.7:::::::*
adobe	acrobat	7.0.8	cpe:2.3:a:adobe:acrobat:7.0.8:::::::*
adobe	acrobat	7.0.9	cpe:2.3:a:adobe:acrobat:7.0.9:::::::*
adobe	acrobat	7.1.0	cpe:2.3:a:adobe:acrobat:7.1.0:::::::*
adobe	acrobat	7.1.1	cpe:2.3:a:adobe:acrobat:7.1.1:::::::*
adobe	acrobat	7.1.2	cpe:2.3:a:adobe:acrobat:7.1.2:::::::*
adobe	acrobat	7.1.3	cpe:2.3:a:adobe:acrobat:7.1.3:::::::*
adobe	acrobat	7.1.4	cpe:2.3:a:adobe:acrobat:7.1.4:::::::*
adobe	acrobat	8.0	cpe:2.3:a:adobe:acrobat:8.0:::::::*
adobe	acrobat	8.1	cpe:2.3:a:adobe:acrobat:8.1:::::::*
adobe	acrobat	8.1.1	cpe:2.3:a:adobe:acrobat:8.1.1:::::::*
adobe	acrobat	8.1.2	cpe:2.3:a:adobe:acrobat:8.1.2:::::::*
adobe	acrobat	8.1.3	cpe:2.3:a:adobe:acrobat:8.1.3:::::::*
adobe	acrobat	8.1.4	cpe:2.3:a:adobe:acrobat:8.1.4:::::::*
adobe	acrobat	8.1.5	cpe:2.3:a:adobe:acrobat:8.1.5:::::::*
adobe	acrobat	8.1.6	cpe:2.3:a:adobe:acrobat:8.1.6:::::::*
adobe	acrobat	8.1.7	cpe:2.3:a:adobe:acrobat:8.1.7:::::::*
adobe	acrobat	9.0	cpe:2.3:a:adobe:acrobat:9.0:::::::*
adobe	acrobat	9.1	cpe:2.3:a:adobe:acrobat:9.1:::::::*
adobe	acrobat	9.1.1	cpe:2.3:a:adobe:acrobat:9.1.1:::::::*
adobe	acrobat	9.1.2	cpe:2.3:a:adobe:acrobat:9.1.2:::::::*
adobe	acrobat	9.1.3	cpe:2.3:a:adobe:acrobat:9.1.3:::::::*
adobe	acrobat_reader	<= 9.2	cpe:2.3:a:adobe:acrobat_reader::::::::
adobe	acrobat_reader	3.0	cpe:2.3:a:adobe:acrobat_reader:3.0:::::::*
adobe	acrobat_reader	3.01	cpe:2.3:a:adobe:acrobat_reader:3.01:::::::*
adobe	acrobat_reader	3.02	cpe:2.3:a:adobe:acrobat_reader:3.02:::::::*
adobe	acrobat_reader	4.0	cpe:2.3:a:adobe:acrobat_reader:4.0:::::::*
adobe	acrobat_reader	4.0.5	cpe:2.3:a:adobe:acrobat_reader:4.0.5:::::::*
adobe	acrobat_reader	4.0.5a	cpe:2.3:a:adobe:acrobat_reader:4.0.5a:::::::*
adobe	acrobat_reader	4.0.5c	cpe:2.3:a:adobe:acrobat_reader:4.0.5c:::::::*
adobe	acrobat_reader	4.5	cpe:2.3:a:adobe:acrobat_reader:4.5:::::::*
adobe	acrobat_reader	5.0	cpe:2.3:a:adobe:acrobat_reader:5.0:::::::*
adobe	acrobat_reader	5.0.5	cpe:2.3:a:adobe:acrobat_reader:5.0.5:::::::*
adobe	acrobat_reader	5.0.6	cpe:2.3:a:adobe:acrobat_reader:5.0.6:::::::*
adobe	acrobat_reader	5.0.7	cpe:2.3:a:adobe:acrobat_reader:5.0.7:::::::*
adobe	acrobat_reader	5.0.9	cpe:2.3:a:adobe:acrobat_reader:5.0.9:::::::*
adobe	acrobat_reader	5.0.10	cpe:2.3:a:adobe:acrobat_reader:5.0.10:::::::*
adobe	acrobat_reader	5.0.11	cpe:2.3:a:adobe:acrobat_reader:5.0.11:::::::*
adobe	acrobat_reader	5.1	cpe:2.3:a:adobe:acrobat_reader:5.1:::::::*
adobe	acrobat_reader	6.0	cpe:2.3:a:adobe:acrobat_reader:6.0:::::::*
adobe	acrobat_reader	6.0.1	cpe:2.3:a:adobe:acrobat_reader:6.0.1:::::::*
adobe	acrobat_reader	6.0.2	cpe:2.3:a:adobe:acrobat_reader:6.0.2:::::::*
adobe	acrobat_reader	6.0.3	cpe:2.3:a:adobe:acrobat_reader:6.0.3:::::::*
adobe	acrobat_reader	6.0.4	cpe:2.3:a:adobe:acrobat_reader:6.0.4:::::::*
adobe	acrobat_reader	6.0.5	cpe:2.3:a:adobe:acrobat_reader:6.0.5:::::::*
adobe	acrobat_reader	7.0	cpe:2.3:a:adobe:acrobat_reader:7.0:::::::*
adobe	acrobat_reader	7.0.1	cpe:2.3:a:adobe:acrobat_reader:7.0.1:::::::*
adobe	acrobat_reader	7.0.2	cpe:2.3:a:adobe:acrobat_reader:7.0.2:::::::*
adobe	acrobat_reader	7.0.3	cpe:2.3:a:adobe:acrobat_reader:7.0.3:::::::*
adobe	acrobat_reader	7.0.4	cpe:2.3:a:adobe:acrobat_reader:7.0.4:::::::*
adobe	acrobat_reader	7.0.5	cpe:2.3:a:adobe:acrobat_reader:7.0.5:::::::*
adobe	acrobat_reader	7.0.6	cpe:2.3:a:adobe:acrobat_reader:7.0.6:::::::*
adobe	acrobat_reader	7.0.7	cpe:2.3:a:adobe:acrobat_reader:7.0.7:::::::*
adobe	acrobat_reader	7.0.8	cpe:2.3:a:adobe:acrobat_reader:7.0.8:::::::*
adobe	acrobat_reader	7.0.9	cpe:2.3:a:adobe:acrobat_reader:7.0.9:::::::*

References for CVE-2009-3958

URL	Tags
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
http://www.adobe.com/support/security/bulletins/apsb10-02.html	Patch Vendor Advisory
http://www.kb.cert.org/vuls/id/773545	US Government Resource
http://www.securityfocus.com/bid/37759
http://www.securitytracker.com/id?1023446
http://www.us-cert.gov/cas/techalerts/TA10-013A.html	US Government Resource
http://www.vupen.com/english/advisories/2010/0103	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/55556
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8455

URL

CVE-2009-3958

Public exploit references (Exploit-DB) for CVE-2009-3958

Exploit prediction scoring system (EPSS) score for CVE-2009-3958

Common vulnerability scoring system (CVSS) metrics for CVE-2009-3958

Weakness enumeration for CVE-2009-3958

OS Trackers for CVE-2009-3958

NVD evaluator notes for CVE-2009-3958

Affected software / configurations for CVE-2009-3958

References for CVE-2009-3958