CVE-2009-0927: Adobe Reader and Acrobat getIcon stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe flaw is a remotely reachable, unauthenticated code execution bug in widely deployed software, is listed in CISA KEV, and has an EPSS probability above 0.96.

What it is

Adobe Reader and Acrobat 9 before 9.1, 8 before 8.1.3, and 7 before 7.1.1 contain a stack-based buffer overflow reached through a crafted argument to the getIcon method of a Collab object. It is a distinct issue from CVE-2009-0658 and allows remote code execution when a victim opens a malicious PDF.

Impact

An attacker can execute arbitrary code in the context of the user running Reader or Acrobat, giving full control of the process and potentially the host. The CVSS 3.1 vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reached over the network by delivering a crafted PDF that the user must open in the vulnerable application; the CVSS vector shows no privileges required but user interaction required (UI:R). No authentication is needed to trigger the flaw.

Exploitation

The vulnerability is listed in CISA KEV with a 2022-03-25 addition date, and EPSS gives a 30-day probability of 0.96632 (99.88th percentile), indicating active exploitation and high likelihood. Reference tags include an Exploit-DB entry and vendor patch advisory, but no ransomware campaign use is documented.

What to do

• Apply the Adobe security bulletin APSB09-04 updates to move Reader and Acrobat to 9.1, 8.1.3 or 7.1.1 or later.
• If immediate patching is not possible, disable or restrict JavaScript and the Collab object handling in Reader and Acrobat, and block untrusted PDFs at the mail and web gateways.
• Enforce a PDF handling policy that opens untrusted documents in a sandboxed or isolated viewer rather than the full desktop application.
• Track the KEV remediation due date of 2022-04-15 and confirm all affected endpoints have been upgraded or removed from service.

Detection

• Monitor for Reader or Acrobat processes spawning child processes such as cmd.exe, powershell.exe or script interpreters, which is abnormal for normal document viewing.
• Search endpoint logs for crashes or access violations in AcroRd32.exe or Acrobat.exe correlated with recently opened PDF files.
• Inspect email and web proxy logs for PDF attachments or downloads containing Collab or getIcon-related object structures, and alert on those from untrusted senders.
• Use file reputation and sandbox detonation for PDFs that invoke the Collab getIcon method or exhibit heap/stack corruption behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.