Vulnerability record

CVE-2009-1862

Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability

HighExploitation confirmedCISA KEV

What should I do?

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run Acrobat and Reader, Flash Player, fix it now.

CISA required action: For Adobe Acrobat and Reader, apply updates per vendor instructions. For Adobe Flash Player, the impacted product is end-of-life and should be disconnected if still in use.

US federal civilian agencies must remediate by Jun 22, 2022.

Patch status

No official fix confirmed yet

Until a fix ships, follow the vendor's mitigations and CISA's required action, limit exposure of affected systems, and watch this record for a patch.

Description

Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Affected products

Products affected by this vulnerability, with versions and the source of each entry
Product	Vendor	Affected versions	Source
Acrobat	Adobe	>= 9.0, <= 9.1.2	NVD
Acrobat and Reader, Flash Player	Adobe	—	KEV
Flash Player	Adobe	>= 9.0, <= 9.0.159.0; >= 10.0, <= 10.0.22.87	NVD

Sources: NVD = NIST National Vulnerability Database; KEV = CISA Known Exploited Vulnerabilities catalog.

Intelligence timeline

Developments from the last 30 days, newest first.

CVSS scoredUpdateKEVSep 30, 2026
CVE-2009-1862 scored CVSS 7.8: Adobe Acrobat and Reader, Flash Player, Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability
CISA lists this as exploited in the wild. Unpatched Acrobat and Reader, Flash Player systems are exposed to active attacks now.
Basis: NIST National Vulnerability Database

1 earlier event is available with a subscription. See plans.

Coverage

We have not published a story about this vulnerability yet.

References

nvd.nist.gov https://nvd.nist.gov/vuln/detail/CVE-2009-1862
blogs.adobe.com http://blogs.adobe.com/psirt/2009/07/potential_adobe_reader_and_fla.html
bugs.adobe.com http://bugs.adobe.com/jira/browse/FP-1265
isc.sans.org http://isc.sans.org/diary.html?storyid=6847
lists.apple.com http://lists.apple.com/archives/security-announce/2009/Sep/msg00003.html
lists.apple.com http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html
news.cnet.com http://news.cnet.com/8301-27080_3-10293389-245.html
secunia.com http://secunia.com/advisories/36193
secunia.com http://secunia.com/advisories/36374
secunia.com http://secunia.com/advisories/36701
security.gentoo.org http://security.gentoo.org/glsa/glsa-200908-04.xml
sunsolve.sun.com http://sunsolve.sun.com/search/document.do?assetkey=1-66-266108-1
support.apple.com http://support.apple.com/kb/HT3864
support.apple.com http://support.apple.com/kb/HT3865
adobe.com http://www.adobe.com/support/security/advisories/apsa09-03.html
adobe.com http://www.adobe.com/support/security/bulletins/apsb09-10.html
adobe.com http://www.adobe.com/support/security/bulletins/apsb09-13.html
kb.cert.org http://www.kb.cert.org/vuls/id/259425
securityfocus.com http://www.securityfocus.com/bid/35759
symantec.com http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-072209-2512-99
symantec.com http://www.symantec.com/connect/blogs/next-generation-flash-vulnerability
cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-1862