Description
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | acroread +1 | 9.3-1.el5 | RHSA-2010:0037 |
| RHEL 4 | acroread +1 | 9.3-1.el4 | RHSA-2010:0038 |
| RHEL 3 | acroread-uninstall | 9.3-3 | RHSA-2010:0060 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Adobe U3D CLODProgressiveMeshDeclaration Array Overrun
exploit/windows/fileformat/adobe_u3d_meshdecl
Exploit-DB 1
- Adobe - U3D CLODProgressiveMeshDeclaration Array Overrun (Metasploit) (2) EDB-16622 · local · Sep 25, 2010 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2010:0060 Red Hat Security Advisory: acroread security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0037 Red Hat Security Advisory: acroread security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0038 Red Hat Security Advisory: acroread security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl
- 38138 third-party-advisory
- oval:org.mitre.oval:def:8242 vdb-entry signature
- http://www.adobe.com/support/security/bulletins/apsb10-02.html
- RHSA-2010:0060 vendor-advisory
- ADV-2010-0103 vdb-entry
- 1023446 vdb-entry
- 61690 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=554293
- acrobat-reader-u3d-code-execution(55551) vdb-entry
- 38215 third-party-advisory
- SUSE-SA:2010:008 vendor-advisory
- TA10-013A third-party-advisory
- 37758 vdb-entry