CVE Feed

    Dashboard / CVE / CVE-2009-1492

    CVE-2009-1492

    The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that contains an annotation, and has an OpenAction entry with JavaScript code that calls this method with crafted integer arguments.

    Published:Apr 27, 2009
    Last Modified:Apr 23, 2026
    EPS:Apr 30, 2009
    EPSS Score:0.68063
    CVSS Score:9.3

    Affected Products

    Vendor
    Adobe
    Product
    Acrobat
    Vendor
    Adobe
    Product
    Acrobat Reader
    Vendor
    Redhat
    Product
    Rhel Extras

    Exploits

    http://packetstorm.linuxsecurity.com/0904-exploits/getannots.txthttp://www.securityfocus.com/bid/34736http://packetstorm.linuxsecurity.com/0904-exploits/getannots.txthttp://www.securityfocus.com/bid/34736https://www.exploit-db.com/exploits/8569

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-81984 (CVSS 5.5) — Acrobat Reader is affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory…
    CVE-2026-81989 (CVSS 7.8) — Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in …
    CVE-2026-81991 (CVSS 5.5) — Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive m…
    CVE-2026-81980 (CVSS 7.8) — Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code executi…
    CVE-2026-81990 (CVSS 7.8) — Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in …
    CVE-2026-81987 (CVSS 7.8) — Acrobat Reader is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary c…
    CVE-2026-79910 (CVSS 5.5) — Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive m…
    CVE-2026-81993 (CVSS 5.5) — Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could lead to disclosure of sens…
    CVE-2026-79907 (CVSS 7.8) — Acrobat Reader is affected by a Double Free vulnerability that could result in arbitrary code execution in the…
    CVE-2026-79909 (CVSS 7.8) — Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in …

    References

    http://blogs.adobe.com/psirt/2009/04/potential_adobe_reader_issue.html
    http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.html
    http://blogs.adobe.com/psirt/2009/05/adobe_reader_issue_update.html
    http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00001.html
    http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
    http://osvdb.org/54130
    http://packetstorm.linuxsecurity.com/0904-exploits/getannots.txt
    http://secunia.com/advisories/34924
    http://secunia.com/advisories/35055
    http://secunia.com/advisories/35096
    http://secunia.com/advisories/35152
    http://secunia.com/advisories/35358
    http://secunia.com/advisories/35416
    http://secunia.com/advisories/35734
    http://security.gentoo.org/glsa/glsa-200907-06.xml
    http://sunsolve.sun.com/search/document.do?assetkey=1-66-259028-1
    http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=926953
    http://www.adobe.com/support/security/bulletins/apsb09-06.html
    http://www.kb.cert.org/vuls/id/970180
    http://www.redhat.com/support/errata/RHSA-2009-0478.html
    http://www.securityfocus.com/bid/34736
    http://www.securitytracker.com/id?1022139
    http://www.us-cert.gov/cas/techalerts/TA09-133B.html
    http://www.vupen.com/english/advisories/2009/1189
    http://www.vupen.com/english/advisories/2009/1317
    https://exchange.xforce.ibmcloud.com/vulnerabilities/50145
    https://www.exploit-db.com/exploits/8569
    http://blogs.adobe.com/psirt/2009/04/potential_adobe_reader_issue.html
    http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.html
    http://blogs.adobe.com/psirt/2009/05/adobe_reader_issue_update.html
    http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00001.html
    http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
    http://osvdb.org/54130
    http://packetstorm.linuxsecurity.com/0904-exploits/getannots.txt
    http://secunia.com/advisories/34924
    http://secunia.com/advisories/35055
    http://secunia.com/advisories/35096
    http://secunia.com/advisories/35152
    http://secunia.com/advisories/35358
    http://secunia.com/advisories/35416
    http://secunia.com/advisories/35734
    http://security.gentoo.org/glsa/glsa-200907-06.xml
    http://sunsolve.sun.com/search/document.do?assetkey=1-66-259028-1
    http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=926953
    http://www.adobe.com/support/security/bulletins/apsb09-06.html
    http://www.kb.cert.org/vuls/id/970180
    http://www.redhat.com/support/errata/RHSA-2009-0478.html
    http://www.securityfocus.com/bid/34736
    http://www.securitytracker.com/id?1022139
    http://www.us-cert.gov/cas/techalerts/TA09-133B.html
    http://www.vupen.com/english/advisories/2009/1189
    http://www.vupen.com/english/advisories/2009/1317
    https://exchange.xforce.ibmcloud.com/vulnerabilities/50145
    https://www.exploit-db.com/exploits/8569

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High