Constellation · CASCA

Constellation explorer

Every signal has a story.Follow the evidence.

Return to triage

Find a CVE by identifier or text

↵ select

Minimum eligible CVSSOrderKEV only

Start with evidence

Current exploration

CVE-2009-3953

Your trail

Where next?

CVE-2009-3953

The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.

11 retained evidence references · snapshot-bound · open authoritative view

StateSource-scoped evidence

Priority86.0–86.8

Coverage98.3%

Connections7

Choose an action.

Evidence state

identity unresolved
known present
source constrained
evidence unknown

Snapshot-bound reason tuple

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Connections 7

has cited scope1 retained · stored CVE-2009-3953 → n/a · n/a

ee38f5e1-a4e2-4525-9ba0-89327d647308

has environmental constraint1 retained · stored CVE-2009-3953 → microsoft · windows

2de467c6-db51-466a-9666-f4d229de62db

has environmental constraint1 retained · stored CVE-2009-3953 → apple · mac_os_x

6d5e1f9b-0ee5-4c66-b5e1-028345e63606

has vulnerable target scope2 retained · stored CVE-2009-3953 → suse · linux_enterprise

8f8e50b2-127d-4e16-acb9-b0f3e8128e64d2be1dce-f392-475e-a586-b32cc6dd94e6

has vulnerable target scope2 retained · stored CVE-2009-3953 → opensuse · opensuse

292d3adf-9307-4683-a011-c57c6b8edcc8834f76cb-1ac4-45f0-9a0e-c6c1a906dac8

has vulnerable target scope1 retained · stored CVE-2009-3953 → suse · linux_enterprise_debuginfo

ca0ed7d0-4261-469e-afb7-4665c84928ae

has vulnerable target scope3 retained · stored CVE-2009-3953 → adobe · acrobat

5f70c318-c1b0-496f-84cb-dfc0fd84e2bda207fefa-3e88-4dbc-9a7a-6a62a499e9dec0db160c-50f6-4f35-a53e-85b88d9e7469

CVEProductSignalSelected / traceVisual proximity carries zero evidence weight.