CVE-2009-3958: Adobe Reader and Acrobat getPlus Helper ActiveX stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw is remotely reachable with no authentication and rated CVSS 10, and EPSS is in the 98.9th percentile, though it is not in KEV and no public exploit is tagged.

What it is

The NOS Microsystems getPlus Helper ActiveX control (gp.ocx) shipped with Adobe Reader and Acrobat 9.x before 9.3 and 8.x before 8.2 contains multiple stack-based buffer overflows. The flaw is reached through unspecified initialization parameters and can corrupt memory in a way that may allow code execution. It matters because the affected control is installed alongside widely deployed Adobe Reader and Acrobat installations on Windows and Mac OS X.

Impact

A remote attacker may execute arbitrary code in the context of the process hosting the ActiveX control, giving full control of the affected system. The CVSS vector rates complete confidentiality, integrity and availability impact.

Attack surface

The vector is network-reachable with no authentication (AV:N/AC:L/Au:N), and the flaw is in an ActiveX control, so it is typically reached by a user visiting a malicious or compromised web page that instantiates the control. User interaction is implied by the ActiveX delivery model, though the record does not state it explicitly.

Exploitation

The record is not listed in CISA KEV and no ransomware use is documented, but EPSS is high at 0.526 probability (98.9th percentile), indicating elevated likelihood of exploitation activity. Reference tags include only Patch, Vendor Advisory and US Government Resource, with no public exploit tag.

What to do

• Update Adobe Reader and Acrobat to 9.3 or 8.2 (or later) per Adobe bulletin APSB10-02, which also addresses the getPlus Helper control.
• Apply the getPlus Helper update to version 1.6.2.49 or later where the control is installed independently.
• Disable or remove the getPlus Helper ActiveX control (gp.ocx) via Internet Explorer killbit or equivalent control-blocking policy on systems that do not need it.
• Restrict browsing to trusted sites and enforce script/ActiveX controls policy for untrusted zones.
• Track vendor and US-CERT advisories for any follow-up guidance on the getPlus control.

Detection

• Inventory endpoints for gp.ocx and the getPlus Helper control, and flag versions below 1.6.2.49.
• Monitor for processes loading gp.ocx, especially browser or Office processes spawning unexpected child processes.
• Hunt for crash or exploit telemetry in browser processes consistent with stack buffer overflow in the getPlus control.
• Review proxy and IDS logs for pages that instantiate the getPlus Helper ActiveX control from untrusted origins.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.