CVE-2009-3955: Adobe Acrobat

High severity, CVSS 10.0. EPSS: 15.8% chance of exploitation in the next 30 days.

Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted JPC_MS_RGN marker in the Jp2c stream of a JpxDecode encoded data stream, which triggers an integer sign extension that bypasses a sanity check, leading to memory corruption.

Affected products

• Adobe Acrobat: up to and including 9.2; version 3.0 only; version 3.1 only; version 4.0 only; version 4.0.5 only; version 4.0.5a only; …
• Adobe Acrobat Reader: up to and including 9.2; version 3.0 only; version 3.01 only; version 3.02 only; version 4.0 only; version 4.0.5 only; …

Published 2010-01-13. Last modified 2026-06-16.