CVE-2009-1492

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 25.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-04-30 · updated 2026-06-16
Weakness: CWE-399

Description

The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that contains an annotation, and has an OpenAction entry with JavaScript code that calls this method with crafted integer arguments.

Affected products

Adobe Acrobat for Edge: from 7.0 through 7.1.1; from 8.0 through 8.1.4; from 9.0 through 9.1
Adobe Acrobat Reader: from 7.0 through 7.1.1; from 8.0 through 8.1.4; from 9.0 through 9.1

References

http://blogs.adobe.com/psirt/2009/04/potential_adobe_reader_issue.html
http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.html
http://blogs.adobe.com/psirt/2009/05/adobe_reader_issue_update.html
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
http://osvdb.org/54130
http://packetstorm.linuxsecurity.com/0904-exploits/getannots.txt
http://secunia.com/advisories/34924
http://secunia.com/advisories/35055
http://secunia.com/advisories/35096
http://secunia.com/advisories/35152
http://secunia.com/advisories/35358

Get alerted when CVE-2009-1492 or the next vulnerability affects your stack