CVE-2009-3958

CVE-2009-3958 is a critical-severity vulnerability in Adobe Acrobat with a CVSS 2.0 base score of 10.0. Its EPSS exploit-prediction score of 53% places it in the 99th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-119.

Key facts

• Severity: Critical (CVSS 2.0 base score 10.0)
• EPSS exploit prediction: 53% (99th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-119
• Affected product: Adobe Acrobat
• Published: 2010-01-13
• Last modified: 2026-06-16

Description

Multiple stack-based buffer overflows in the NOS Microsystems getPlus Helper ActiveX control before 1.6.2.49 in gp.ocx in the Download Manager in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, might allow remote attackers to execute arbitrary code via unspecified initialization parameters.

Frequently asked questions

What is CVE-2009-3958?

Multiple stack-based buffer overflows in the NOS Microsystems getPlus Helper ActiveX control before 1.6.2.49 in gp.ocx in the Download Manager in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, might allow remote attackers to execute arbitrary code via unspecified initialization parameters.

How severe is CVE-2009-3958?

CVE-2009-3958 has a CVSS 2.0 base score of 10.0, rated critical severity.

Is CVE-2009-3958 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 53% (99th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2009-3958?

CVE-2009-3958 primarily affects Adobe Acrobat. In total, 97 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2009-3958?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2009-3958 published?

CVE-2009-3958 was published on 2010-01-13 and last updated on 2026-06-16.

References

• http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
• http://www.adobe.com/support/security/bulletins/apsb10-02.html
• http://www.kb.cert.org/vuls/id/773545
• http://www.securityfocus.com/bid/37759
• http://www.securitytracker.com/id?1023446
• http://www.us-cert.gov/cas/techalerts/TA10-013A.html
• http://www.vupen.com/english/advisories/2010/0103
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55556
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8455

Affected products (97)

• cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:3.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:3.1:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:4.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:4.0.5:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:4.0.5a:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:4.0.5c:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:5.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:5.0.5:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:5.0.6:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:5.0.10:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:6.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:6.0.2:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:6.0.3:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:6.0.4:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:6.0.5:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:6.0.6:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.2:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.3:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.4:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.5:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.6:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.7:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.8:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.9:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.1.1:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.1.2:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.1.3:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.1.4:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:8.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:8.1:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:8.1.1:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:8.1.2:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:8.1.3:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:8.1.4:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:8.1.5:*:*:*:*:*:*:*

More vulnerabilities in Adobe Acrobat

• CVE-2018-4872 — Critical (CVSS 10.0): An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier…
• CVE-2016-1044 — Critical (CVSS 10.0): Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and…
• CVE-2016-1041 — Critical (CVSS 10.0): Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and…
• CVE-2016-1038 — Critical (CVSS 10.0): Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and…
• CVE-2015-7622 — Critical (CVSS 10.0): Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before…
• CVE-2015-6691 — Critical (CVSS 10.0): Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and…

All CVEs affecting Adobe Acrobat →

Other CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities

• CVE-2026-2778 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in…
• CVE-2026-2776 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability…
• CVE-2025-1866 — Critical (CVSS 10.0): Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in warmcat libwebsockets allows…
• CVE-2022-27625 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
• CVE-2022-27624 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
• CVE-2020-11896 — Critical (CVSS 10.0): The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

Browse all CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities →