CVE-2009-4324
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader...
CVE-2009-4324 is a high vulnerability (CVSS 7.8) in Adobe Acrobat, published December 15, 2009. CISA lists it as known to be exploited, since June 8, 2022. EUVD reports exploitation since June 8, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 81.9%, the 99th percentile. No source names a fixed version.
- Severity
- 7.8 HighCVSS 3.1, NVD
- Exploit chance
- 81.9%EPSS, 99th percentile
- Exploitation
- ExploitedCISA KEV,
- Fixed in
- No fix listedNo source names one
Description
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
acroreadRed Hat:rhel_extras:5::client From an advisory covering 6 CVEs | before 0:9.3-1.el5 | 0:9.3-1.el5 |
acroread-pluginRed Hat:rhel_extras:5::client From an advisory covering 6 CVEs | before 0:9.3-1.el5 | 0:9.3-1.el5 |
acroreadRed Hat:rhel_extras:5::server From an advisory covering 6 CVEs | before 0:9.3-1.el5 | 0:9.3-1.el5 |
acroread-pluginRed Hat:rhel_extras:5::server From an advisory covering 6 CVEs | before 0:9.3-1.el5 | 0:9.3-1.el5 |
acroreadRed Hat:rhel_extras:4 From an advisory covering 6 CVEs | before 0:9.3-1.el4 | 0:9.3-1.el4 |
acroread-pluginRed Hat:rhel_extras:4 From an advisory covering 6 CVEs | before 0:9.3-1.el4 | 0:9.3-1.el4 |
acroread-uninstallRed Hat:rhel_extras:3 From an advisory covering 6 CVEs | before 0:9.3-3 | 0:9.3-3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Adobe Doc.media.newPlayer Use After Free Vulnerability | 2009-12-14 |
| Metasploit | Adobe Doc.media.newPlayer Use After Free Vulnerability | 2009-12-14 |
| Exploit-DB | Adobe Reader / Acrobat - '.PDF' File Overflow | 2009-12-23 |
| Exploit-DB | Adobe - 'Doc.media.newPlayer' Use-After-Free (Metasploit) (1) | 2010-04-30 |
| Exploit-DB | Adobe - 'Doc.media.newPlayer' Use-After-Free (Metasploit) (2) | 2010-09-25 |
What each source reports
NVD Score used
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
- Record
CVE-2009-4324- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
- Record
CVE-2009-4324- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2009-4292
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
- Record
EUVD-2009-4292- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rv25-qx26-27xv
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader...
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
- Record
GHSA-rv25-qx26-27xv- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
CISA KEVNo score
Adobe Acrobat and Reader Use-After-Free Vulnerability
Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.
- Record
CVE-2009-4324- Weakness
- CWE-399
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securityfocus.com/bid/37331
blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html
secunia.com/advisories/37690
bugzilla.redhat.com/show_bug.cgi?id=547799
osvdb.org/60980
Show 47 moreShow less
kb.cert.org/vuls/id/508357
exchange.xforce.ibmcloud.com/vulnerabilities/54747
vupen.com/english/advisories/2009/3518
metasploit.com/redmine/projects/framework/repository/revisions/7881/entry/modules/exploits/windows/fileformat/adobe_media_newplayer.rb
adobe.com/support/security/bulletins/apsb10-02.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6795
redhat.com/support/errata/RHSA-2010-0060.html
contagiodump.blogspot.com/2009/12/virustotal-httpwww.html
symantec.com/connect/blogs/zero-day-xmas-present
shadowserver.org/wiki/pmwiki.php/Calendar/20091214
lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
us-cert.gov/cas/techalerts/TA10-013A.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-4324
nvd.nist.gov/vuln/detail/CVE-2009-4324
github.com/advisories/GHSA-rv25-qx26-27xv
access.redhat.com/errata/RHSA-2010:0037
security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0037.json
cve.org/CVERecord?id=CVE-2009-3953