Adobe · Acrobat and Reader, Flash Player
CVE-2009-1862
Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability
What it is
Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009.
CISA: Adobe Acrobat and Reader and Adobe Flash Player allows remote attackers to execute code or cause denial-of-service (DoS).
What to do
For Adobe Acrobat and Reader, apply updates per vendor instructions. For Adobe Flash Player, the impacted product is end-of-life and should be disconnected if still in use.
Deadline for US federal agencies: June 22, 2022
- Added to the CISA list
- June 8, 2022
- Published
- July 23, 2009
- Severity
- High 7.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 21% in the top 2.4% of all known vulnerabilities
- Weakness
- CWE-94
- More details
- NVD · CVE.org · CISA
All references (20)
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-266108-1
- http://lists.apple.com/archives/security-announce/2009/Sep/msg00003.html
- http://security.gentoo.org/glsa/glsa-200908-04.xml
- http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html
- http://www.kb.cert.org/vuls/id/259425
- http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-072209-2512-99
- http://support.apple.com/kb/HT3864
- http://isc.sans.org/diary.html?storyid=6847
- http://www.adobe.com/support/security/bulletins/apsb09-13.html
- http://blogs.adobe.com/psirt/2009/07/potential_adobe_reader_and_fla.html
- http://www.symantec.com/connect/blogs/next-generation-flash-vulnerability
- http://bugs.adobe.com/jira/browse/FP-1265
- http://www.adobe.com/support/security/bulletins/apsb09-10.html
- http://secunia.com/advisories/36374
- http://support.apple.com/kb/HT3865
- http://secunia.com/advisories/36193
- http://secunia.com/advisories/36701
- http://www.adobe.com/support/security/advisories/apsa09-03.html
- http://news.cnet.com/8301-27080_3-10293389-245.html
- http://www.securityfocus.com/bid/35759
More exploited flaws from Adobe
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 27, 2026 | Unrestricted Upload of File with Dangerous Type | Commerce and Magento | Critical 9.3 | 31% |
| Sep 24, 2026 | Commerce and Magento Incorrect Authorization Vulnerability | Commerce and Magento | Critical 9.1 | 90% |
| Sep 8, 2026 | Improper Neutralization of Special Elements Used in a Template Engine | Commerce and Magento | Critical 10.0 | 3.9% |
| Jul 7, 2026 | Path Traversal | ColdFusion | Critical 10.0 | 42% |
| May 20, 2026 | Heap-Based Buffer Overflow | Acrobat and Reader | High 8.8 | 87% |
| Apr 13, 2026 | Use-After-Free | Acrobat | High 7.8 | 33% |
| Apr 13, 2026 | Prototype Pollution | Acrobat and Reader | High 8.6 | 7.2% |
| Oct 24, 2025 | Improper Input Validation | Commerce and Magento | Critical 9.1 | 95% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.