CVE-2009-0658
Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote...
CVE-2009-0658 is a high vulnerability (CVSS 7.8) in Adobe Acrobat, published February 20, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 87.8%, the 99th percentile. No source names a fixed version.
- Severity
- 7.8 HighCVSS 3.1, NVD
- Exploit chance
- 87.8%EPSS, 99th percentile
- Exploitation
- None known6 public exploits
- Fixed in
- No fix listedNo source names one
Description
Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitrary code via a crafted PDF document, related to a non-JavaScript function call and possibly an embedded JBIG2 image stream, as exploited in the wild in February 2009 by Trojan.Pidief.E.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
acroreadRed Hat:rhel_extras:3 From an advisory covering 5 CVEs | before 0:8.1.4-1 | 0:8.1.4-1 |
acroread-pluginRed Hat:rhel_extras:3 From an advisory covering 5 CVEs | before 0:8.1.4-1 | 0:8.1.4-1 |
acroreadRed Hat:rhel_extras:4 From an advisory covering 5 CVEs | before 0:8.1.4-1.el4 | 0:8.1.4-1.el4 |
acroread-pluginRed Hat:rhel_extras:4 From an advisory covering 5 CVEs | before 0:8.1.4-1.el4 | 0:8.1.4-1.el4 |
acroreadRed Hat:rhel_extras:5::client From an advisory covering 5 CVEs | before 0:8.1.4-1.el5 | 0:8.1.4-1.el5 |
acroread-pluginRed Hat:rhel_extras:5::client From an advisory covering 5 CVEs | before 0:8.1.4-1.el5 | 0:8.1.4-1.el5 |
acroreadRed Hat:rhel_extras:5::server From an advisory covering 5 CVEs | before 0:8.1.4-1.el5 | 0:8.1.4-1.el5 |
acroread-pluginRed Hat:rhel_extras:5::server From an advisory covering 5 CVEs | before 0:8.1.4-1.el5 | 0:8.1.4-1.el5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Adobe JBIG2Decode Heap Corruption | 2009-02-19 |
| Metasploit | Adobe JBIG2Decode Memory Corruption | 2009-02-19 |
| Exploit-DB | Adobe Acrobat Reader - JBIG2 Local Buffer Overflow (PoC) (2) | 2009-02-23 |
| Exploit-DB | Adobe - JBIG2Decode Memory Corruption (Metasploit) (1) | 2010-06-15 |
| Exploit-DB | Adobe - JBIG2Decode Memory Corruption (Metasploit) (2) | 2010-09-25 |
| PoC in GitHub | kyaw-tun/blue-team-capstone | 2026-08-23 |
What each source reports
NVD Score used
Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitrary code via a crafted PDF document, related to a non-JavaScript function call and possibly an embedded JBIG2 image stream, as exploited in the wild in February 2009 by Trojan.Pidief.E.
- Record
CVE-2009-0658- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitrary code via a crafted PDF document, related to a non-JavaScript function call and possibly an embedded JBIG2 image stream, as exploited in the wild in February 2009 by Trojan.Pidief.E.
- Record
CVE-2009-0658- Updated
- 2026-11-02
EUVDEUVD-2009-0661No score
Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitrary code via a crafted PDF document, related to a non-JavaScript function call and possibly an embedded JBIG2 image stream, as exploited in the wild in February 2009 by Trojan.Pidief.E.
- Record
EUVD-2009-0661- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pm5j-jrq9-vmhx
Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote...
Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitrary code via a crafted PDF document, related to a non-JavaScript function call and possibly an embedded JBIG2 image stream, as exploited in the wild in February 2009 by Trojan.Pidief.E.
- Record
GHSA-pm5j-jrq9-vmhx- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
shadowserver.org/wiki/pmwiki.php?n=Calendar.20090219
secunia.com/advisories/34790
adobe.com/support/security/bulletins/apsb09-04.html
exploit-db.com/exploits/8099
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5697
isc.sans.org/diary.html?n&storyid=5902
Show 40 moreShow less
us-cert.gov/cas/techalerts/TA09-051A.html
osvdb.org/52073
redhat.com/support/errata/RHSA-2009-0376.html
symantec.com/security_response/writeup.jsp?docid=2009-021212-5523-99&tabid=2
lists.opensuse.org/opensuse-security-announce/2009-03/msg00005.html
vupen.com/english/advisories/2009/0472
kb.cert.org/vuls/id/905281
sunsolve.sun.com/search/document.do?assetkey=1-66-256788-1
securityfocus.com/bid/33751
exchange.xforce.ibmcloud.com/vulnerabilities/48825
securitytracker.com/id?1021739
security.gentoo.org/glsa/glsa-200904-17.xml
nvd.nist.gov/vuln/detail/CVE-2009-0658
github.com/advisories/GHSA-pm5j-jrq9-vmhx
access.redhat.com/errata/RHSA-2009:0376
bugzilla.redhat.com/show_bug.cgi?id=486928
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0376.json
cve.org/CVERecord?id=CVE-2009-0193