Use‑After‑Free in Adobe Acrobat/Reader (CVE‑2009‑4324) Enables Remote Code Execution via Malicious PDF
What It Is – A use‑after‑free flaw in Adobe Acrobat and Reader allows a remote attacker to execute arbitrary code by delivering a crafted PDF file.
Exploitability – Publicly disclosed; proof‑of‑concept PDFs exist and can be delivered via email or web download. The vulnerability is rated High severity (CVSS ≈ 7.8).
Affected Products – Adobe Acrobat (all versions prior to the 9.0.2 patch) and Adobe Reader (all versions prior to the 9.0.2 patch).
Why It Matters for Trust & Control Assurance
- Vulnerability Management – The flaw tests the control objective of maintaining an up‑to‑date patch‑management process and continuous vulnerability monitoring.
- Audit Evidence – Demonstrating timely remediation provides defensible evidence for auditors that the organization exercises due diligence over third‑party software.
- Enterprise Buyer Expectations – Large buyers now request proof that critical application vulnerabilities are tracked, assessed, and patched as part of a broader trust posture.
Recommended Actions
- Identify all endpoints running vulnerable versions of Acrobat/Reader.
- Apply Adobe’s security update (version 9.0.2 or later) immediately.
- Update asset inventories and tag the remediation as evidence of control execution.
- Enable continuous scanning for vulnerable PDF readers and integrate findings into your security‑control dashboard.
Source: CISA KEV – CVE‑2009‑4324