Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 83.9%; technical severity is CVSS 8.8.
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.
Who should care
- Teams operating Acrobat, Acrobat and Reader, Opensuse +2 more
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether Acrobat, Acrobat and Reader, Opensuse +2 more is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Adobe Security patch APSB10-02
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Treatment intelligence
Remediation intelligence
Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.
Verification noteAutomated link verification has not completed for this guidance yet.
Advisory
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CWE
- CWE-119
- Affected versions
- Adobe Acrobat (Start Including 7.0, End Excluding 7.1.4 | Start Including 8.0, End Excluding 8.2 | Start Including 9.0, End Excluding 9.3); Adobe Acrobat and Reader; Opensuse Opensuse (Version 11.1 | Version 11.2); Suse Linux Enterprise (Version 10.0 | Version 10.0); Suse Linux Enterprise Debuginfo (Version 11)
- Fixed versions
- Adobe Acrobat (Fixed from 7.1.4, 8.2, 9.3)
- Published
- 13 January 2010
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 83.9%
- Signal calculated at 82
External references
- CISA Government advisory CVE-2009-3953
- Lists Opensuse Third-party advisory Msg00009
- Secunia Technical reference
- Secunia Technical reference
- Metasploit Exploit information Adobe U3d Meshdecl
- Securityfocus Third-party advisory
- Securitytracker Third-party advisory
- Us Cert Government advisory TA10 013A
- Vupen Technical reference
- Exchange Xforce Ibmcloud Third-party advisory
- Oval Cisecurity Technical reference Oval%3Aorg.mitre.oval%3Adef%3A8242