Adobe Reader, Acrobat, and Flash Player Remote Code Execution Vulnerability (CVE-2009-1862, authplay.dll Memory Corruption)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2009-1862) is a critical memory corruption issue (CWE-787) that exists in the way Adobe Reader, Acrobat, and Flash Player handle Shockwave Flash (SWF) content. Specifically, the vulnerability resides within the authplay.dll module, which is utilized by Adobe Reader and Acrobat to render embedded Flash multimedia. Due to insufficient input validation when parsing malformed Flash applications or SWF files, an attacker can trigger a memory corruption state, allowing control over the instruction pointer.

2. Exploitation Mechanics & Attack Scenario

Attackers exploit this vulnerability through two primary vectors. First, they can embed a malicious SWF payload inside a PDF document and distribute it via spear-phishing emails. When a victim opens the PDF using a vulnerable version of Adobe Reader or Acrobat, the application automatically loads authplay.dll to process the Flash content, triggering the exploit and executing arbitrary code. Second, attackers can host malicious SWF files on compromised websites to target users visiting via browsers with vulnerable Flash Player plugins. This vulnerability was actively exploited in the wild as a zero-day in July 2009.

3. Infrastructure & Business Impact

Although rated with a CVSS score of 7.8 (High), the real-world impact is severe because successful exploitation leads to full system compromise under the context of the executing user. In an enterprise environment, this can serve as an initial entry point for threat actors, enabling lateral movement, sensitive data exfiltration, and ransomware deployment. Its inclusion in the CISA KEV catalog highlights its historical and ongoing relevance in targeted attack campaigns.