Heap Buffer Overflow in Adobe Acrobat/Reader (CVE-2009-3459) — Crafted PDF May Allow Remote Code Execution

This vulnerability stems from how Adobe Acrobat and Reader handle memory when processing PDFs. A heap-based buffer overflow occurs when more data than a memory region is meant to hold gets written into it, corrupting internal data structures and creating room for attacker-supplied code to run. CISA's record states that a crafted PDF file induces memory corruption and may allow a remote attacker to execute arbitrary code. The attack requires the user to open the file (reflected as UI:R, meaning user interaction is needed, in the CVSS metrics), so everyday actions such as opening an email attachment or a downloaded document can serve as the entry point.

PDF is one of the most commonly opened document formats in both work and personal contexts, making this a textbook case of a document file itself becoming the attack vector. The official NVD CVSS score (a common standard for quantifying severity) is 8.8 (HIGH; CVSS:3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), a band reflecting high potential impact to confidentiality, integrity, and availability. Although this was originally disclosed back in 2009, its addition to the KEV catalog in May 2026 illustrates how continuing to run unsupported, outdated versions can still translate into real-world exposure.

The basic way to address this is to check the version of Acrobat/Reader in use and update to a supported release following Adobe's guidance. Under Binding Operational Directive (BOD) 22-01, CISA directs federal agencies to apply mitigations per vendor instructions, and to discontinue use of the product if mitigations cannot be applied. The remediation due date is set to 2026-06-03.