Search/CVE-2009-3953
● CVE — High

CVE-2009-3953

Vendoradobe, suse, opensuseProductacrobat, linux enterprise debuginfo, opensuse, linux enterpriseDiscoveredJan 13, 2010UpdatedApr 21, 2026

The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.

View graph Watch Export
CVSS v3.1
8.8 HIGH
EPSS
83.2%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Sep 25, 2026
▼ 0.64pp
83.9% → 83.2% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Connections
5 relationships
Timeline
disclosure → media coverage
Jan 13, 2010
Disclosure — published as a CVE record. · last revised by NVD Apr 21, 2026