CVE-2009-1709

Use-after-free vulnerability in the garbage-collection implementation in WebCore in WebKit in...

9.3 High

Use-after-free vulnerability in the garbage-collection implementation in WebCore in WebKit in Apple Safari before 4.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via an SVG animation element, related to SVG set objects, SVG marker elements, the targetElement attribute, and unspecified "caches."

Exploit likelihood

6.92%Up 0.8 points since Feb 4, 2022

What each source reports

NVD Score used 9.3

Record: CVE-2009-1709
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-399
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-1709
Updated: 2026-11-02

EUVDEUVD-2009-1704 No score

Record: EUVD-2009-1704
Updated: 2026-11-03

GitHub AdvisoriesGHSA-grpq-h627-xvm6 No score

Use-after-free vulnerability in the garbage-collection implementation in WebCore in WebKit in...

Record: GHSA-grpq-h627-xvm6
Updated: 2026-11-02

Affected products

apple safari

Affected packages

Affected packages
Package	Affected	Fixed
`kdegraphics` Debian:4.0 From an advisory covering 2 CVEs	before 4:3.5.5-3etch4, plus listed versions 4:3.5.5-34:3.5.5-3etch14:3.5.5-3etch24:3.5.5-3etch3	4:3.5.5-3etch4
`kdegraphics` Debian:5.0 From an advisory covering 2 CVEs	before 4:3.5.9-3+lenny2, plus listed versions 4:3.5.9-34:3.5.9-3+lenny1	4:3.5.9-3+lenny2
`kdegraphics` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs	before 7:3.5.4-13.el5_3	7:3.5.4-13.el5_3
`kdegraphics-debuginfo` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs	before 7:3.5.4-13.el5_3	7:3.5.4-13.el5_3
`kdegraphics-devel` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs	before 7:3.5.4-13.el5_3	7:3.5.4-13.el5_3
`kdegraphics` Red Hat:enterprise_linux:5::client From an advisory covering 2 CVEs	before 7:3.5.4-13.el5_3	7:3.5.4-13.el5_3
`kdegraphics-debuginfo` Red Hat:enterprise_linux:5::client From an advisory covering 2 CVEs	before 7:3.5.4-13.el5_3	7:3.5.4-13.el5_3
`kdegraphics` Red Hat:rhel_productivity:5 From an advisory covering 2 CVEs	before 7:3.5.4-13.el5_3	7:3.5.4-13.el5_3
`kdegraphics-debuginfo` Red Hat:rhel_productivity:5 From an advisory covering 2 CVEs	before 7:3.5.4-13.el5_3	7:3.5.4-13.el5_3
`kdegraphics-devel` Red Hat:rhel_productivity:5 From an advisory covering 2 CVEs	before 7:3.5.4-13.el5_3	7:3.5.4-13.el5_3

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-1709 is a high vulnerability (CVSS 9.3) in Apple Safari, published June 10, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.92%, the 94th percentile. No source names a fixed version.

References

Show 24 moreShow less