Is CVE-2009-1862 being actively exploited?

Yes. CVE-2009-1862 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on June 8, 2022.

What is the CVSS score for CVE-2009-1862?

CVE-2009-1862 has a CVSS 3.1 base score of 7.8 (HIGH).

CVE-2009-1862

HIGH · CVSS 7.8CISA KEV: actively exploitedEPSS 21.2%EU EUVD: exploited

Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009.

Key facts

CVSS score: 7.8 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-787
EPSS score: 21.2% (98th percentile)
In CISA KEV: Yes, added June 8, 2022
In EU EUVD: Yes (EUVD-2009-1857)
Published: July 23, 2009
NVD last modified: June 16, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability

Added to the KEV catalog on June 8, 2022; federal remediation due June 22, 2022.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2009-1857 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 22, 2025.

View on the EU Vulnerability Database

Affected products

adobe / acrobat
adobe / acrobat reader
adobe / flash player

References

http://blogs.adobe.com/psirt/2009/07/potential_adobe_reader_and_fla.html(Broken Link, Vendor Advisory)
http://bugs.adobe.com/jira/browse/FP-1265(Broken Link)
http://isc.sans.org/diary.html?storyid=6847(Not Applicable)
http://lists.apple.com/archives/security-announce/2009/Sep/msg00003.html(Mailing List, Third Party Advisory)
http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html(Mailing List, Third Party Advisory)
http://news.cnet.com/8301-27080_3-10293389-245.html(Broken Link)
http://secunia.com/advisories/36193(Broken Link)
http://secunia.com/advisories/36374(Broken Link)
http://secunia.com/advisories/36701(Broken Link)
http://security.gentoo.org/glsa/glsa-200908-04.xml(Third Party Advisory)
http://sunsolve.sun.com/search/document.do?assetkey=1-66-266108-1(Broken Link)
http://support.apple.com/kb/HT3864(Third Party Advisory)
http://support.apple.com/kb/HT3865(Third Party Advisory)
http://www.adobe.com/support/security/advisories/apsa09-03.html(Vendor Advisory)
http://www.adobe.com/support/security/bulletins/apsb09-10.html(Not Applicable)
http://www.adobe.com/support/security/bulletins/apsb09-13.html(Not Applicable)
http://www.kb.cert.org/vuls/id/259425(Third Party Advisory, US Government Resource)
http://www.securityfocus.com/bid/35759(Broken Link, Third Party Advisory, VDB Entry)
http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-072209-2512-99(Broken Link)
http://www.symantec.com/connect/blogs/next-generation-flash-vulnerability(Broken Link)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-1862(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain