CVE-2009-3956

no score yetEPSS 7.7%

adobe: no CVSS score yet. EPSS 7.7% chance of exploitation in the next 30 days.

The default configuration of Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, does not enable the Enhanced Security feature, which has unspecified impact and attack vectors, related to a "script injection vulnerability," as demonstrated by Acrobat Forms Data Format (FDF) behavior that allows cross-site scripting (XSS) by user-assisted remote attackers.

EPSS: 7.7% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWE: CWE-16
Published: 2010-01-13
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

adobe:acrobat
adobe:acrobat_reader

References

http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
http://secunia.com/advisories/38138
http://secunia.com/advisories/38215
http://www.adobe.com/support/security/bulletins/apsb10-02.html
http://www.packetstormsecurity.org/1001-exploits/SS-2010-001.txt

Check your stack JSON