Vulnerability record · CVE-2009-1862 · published 23 July 2009
CVE-2009-1862: Adobe Reader, Acrobat and Flash Player memory corruption via crafted PDF or SWF
Adobe · Acrobat
Adobe Reader and Acrobat 9.x through 9.1.2 and Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87 contain an out-of-bounds write in authplay.dll that corrupts memory when parsing a crafted Flash application embedded in a PDF or a crafted SWF file. The flaw was exploited in the wild in July 2009 and is listed in CISA KEV, so unpatched or end-of-life installations remain a real risk.
Description
Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityRemote code execution with confirmed in-the-wild exploitation and KEV listing, but exploitation requires the victim to open a crafted file and the affected products are largely legacy or end-of-life.
What it is
Adobe Reader and Acrobat 9.x through 9.1.2 and Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87 contain an out-of-bounds write in authplay.dll that corrupts memory when parsing a crafted Flash application embedded in a PDF or a crafted SWF file. The flaw was exploited in the wild in July 2009 and is listed in CISA KEV, so unpatched or end-of-life installations remain a real risk.
Impact
An attacker can execute arbitrary code in the context of the affected application or crash it, giving full control of the process and potentially the host.
Attack surface
Reached by getting a victim to open a malicious PDF or SWF file, typically via a web page, email attachment or link. The CVSS vector shows no privileges required but user interaction is required (UI:R), so the victim must open the crafted content.
Exploitation
Adobe confirmed exploitation in the wild in July 2009 and CISA added it to KEV on 2022-06-08 with a 2022-06-22 remediation due date. EPSS gives a 30-day probability of 0.25006 (97.8th percentile), and no ransomware campaign use is documented.
What to do
- Apply the Adobe updates referenced in APSA09-03 and APSB09-10/APSB09-13 for Reader, Acrobat and Flash Player; patch first.
- Disconnect or remove Adobe Flash Player, which is end-of-life, per the CISA KEV required action.
- Upgrade Reader and Acrobat to a current supported release; versions 9.x through 9.1.2 are affected.
- Block or restrict opening of untrusted PDF and SWF content, and disable Flash content rendering in Reader where possible.
- Apply the third-party fixes for bundled Flash (Apple, Gentoo, Sun) on affected platforms.
Detection
- Hunt for Reader, Acrobat or Flash Player processes spawning child processes or writing executables after opening a PDF or SWF.
- Monitor for crashes in authplay.dll or Reader/Acrobat memory-corruption events correlated with recently opened PDF or SWF files.
- Search endpoint and email telemetry for PDFs or SWFs with embedded Flash content delivered from external or untrusted sources.
- Check asset inventories for hosts still running Flash Player or Reader/Acrobat 9.x through 9.1.2.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2009-1862 to the Known Exploited Vulnerabilities catalog on 8 June 2022 as "Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability". Required action: For Adobe Acrobat and Reader, apply updates per vendor instructions. For Adobe Flash Player, the impacted product is end-of-life and should be disconnected if still in use. Federal deadline 22 June 2022.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2009-1862 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2009-1862), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
