What’s Vulnerable › Vulnerabilities

CVE-2009-3953: Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-06-08
• EPSS: 83.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2010-01-13 · updated 2026-06-16
• Weakness: CWE-787

Description

The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.

Affected products

• Adobe Acrobat for Edge: from 7.0 before 7.1.4; from 8.0 before 8.2; from 9.0 before 9.3 — fixed in 7.1.4, 8.2, 9.3
• Opensuse: 11.1, 11.2
• SUSE Linux Enterprise: 10.0-sp2, 10.0-sp3
• SUSE Linux Enterprise Debuginfo: 11

How to fix

Upgrade to a fixed version: Adobe Acrobat for Edge 7.1.4, 8.2, 9.3. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
• http://osvdb.org/61690
• http://secunia.com/advisories/38138
• http://secunia.com/advisories/38215
• http://www.adobe.com/support/security/bulletins/apsb10-02.html
• http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl
• http://www.redhat.com/support/errata/RHSA-2010-0060.html
• http://www.securityfocus.com/bid/37758
• http://www.securitytracker.com/id?1023446
• http://www.us-cert.gov/cas/techalerts/TA10-013A.html
• http://www.vupen.com/english/advisories/2010/0103
• https://bugzilla.redhat.com/show_bug.cgi?id=554293

Get alerted when CVE-2009-3953 or the next vulnerability affects your stack