Loading vulnerability…
CVE-2009-3459 is a heap-based buffer overflow vulnerability in Adobe Reader and Adobe Acrobat. It affects Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2. The flaw can be triggered when a victim opens a specially crafted PDF file, causing memory corruption in the application heap and enabling arbitrary code execution. The provided content does not identify the exact vulnerable function, but consistently describes the issue as a malformed PDF-triggered heap overflow that was exploited in the wild in October 2009.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit module: 'adobe_flatedecode_predictor02.rb', which exploits an integer overflow vulnerability (CVE-2009-3459) in Adobe Reader and Acrobat Professional versions prior to 9.2 on Windows. The exploit works by serving a specially crafted PDF file via an HTTP server. When a victim opens the PDF (typically by visiting a malicious web page), embedded JavaScript performs a heap spray to execute attacker-supplied shellcode. The module allows for customizable payloads using Metasploit's framework, and the attack vector is browser-based, requiring user interaction. The code is written in Ruby and leverages Metasploit's HTTP server and payload generation capabilities. No hardcoded IPs, domains, or file paths are present; the main fingerprintable endpoint is the HTTP server delivering the malicious PDF.
This repository contains a single Metasploit module (adobe_flatedecode_predictor02.rb) that exploits an integer overflow vulnerability (CVE-2009-3459) in Adobe Reader and Acrobat Professional versions prior to 9.2 on Windows. The exploit works by generating a specially crafted PDF file (default name: msf.pdf) containing JavaScript that performs a heap spray with user-supplied shellcode. When a vulnerable user opens the PDF, the exploit triggers the overflow, allowing arbitrary code execution. The module allows the operator to specify the payload, which is encoded and embedded in the PDF. The code is written in Ruby and leverages Metasploit's FILEFORMAT exploit mixin. The only fingerprintable endpoint is the generated PDF file itself, which must be delivered to the target for exploitation. The exploit is operational and requires user interaction (opening the PDF) to succeed.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A heap-based buffer overflow vulnerability in Adobe Acrobat and Reader triggered by malicious PDF files.
A critical heap-based buffer overflow vulnerability in Adobe Acrobat and Adobe Reader that can lead to arbitrary code execution via a crafted PDF file.
A heap-based buffer overflow remote code execution vulnerability in Adobe Acrobat and Reader triggered by a crafted PDF file.
A critical heap-based buffer overflow in Adobe Acrobat and Reader that enables arbitrary code execution via malformed PDF files.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.