← All detection heuristics · CVE
critical
CVE exact
CVE_2009_3459
What it means
PDF /DecodeParms predictor parameters force an integer overflow in the per-row buffer size.
Why it fires
CVE-2009-3459 is a heap-based buffer overflow in Adobe Reader / Acrobat before 9.2 / 8.1.7 / 7.1.4 (APSB09-15), exploited in the wild in October 2009. A /DecodeParms predictor (TIFF Predictor 2 or PNG predictors 10-15) makes the reader size a per-row buffer from /Columns * /Colors * /BitsPerComponent; an attacker sets an absurd scalar (e.g. /Colors 1073741838) so that product overflows a 32-bit allocation and the inflated stream overruns it. Legitimate predictor params are tiny (Colors is bounded by the colour model, BitsPerComponent is one of 1/2/4/8/16). The oversized scalar validates the integer-overflow primitive used by CVE-2009-3459 and matches the Metasploit adobe_flatedecode_predictor02 implementation.
Other CVE heuristics
CVE_2026_34621_RELATED CVE_2023_26369 CVE_2026_34621 CVE_2010_1297_FLASH_RICHMEDIA CVE_2010_1297_SWF_TRIGGER CVE_2011_0611_SWF_TRIGGER CVE_2009_1862_FLASH_RICHMEDIA CVE_2010_2883 CVE_2018_4901 CVE_2018_4990_JPX_EMBEDDED_CMD CVE_2018_4990_JPX_CMAP_TRIGGER CVE_2010_1240 CVE_2010_0188 CVE_2014_0514 CVE_2013_3346 CVE_2013_0640 CVE_2010_3654_FLASH_RICHMEDIA CVE_2007_5020_MAILTO_MSHTA CVE_2014_0496 CVE_2008_2551 CVE_2021_40444 CVE_2006_4694 CVE_2008_0118 CVE_2009_0658