$ cve CVE-2009-2564 JSON

CVE-2009-2564 EXPLOIT

7.2

HIGH · CVSS 2.0 · EPSS 5.6% (pctl 93)

Patch early

A public exploit exists.

Description

NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot.

Scoring

CVSS	7.2 (HIGH, v2.0)
Vector	AV:L/AC:L/Au:N/C:C/I:C/A:C
EPSS	5.64% — more likely to be exploited than 93% of all CVEs
Weakness	CWE-264
On CISA KEV	no
Public exploit	yes
Published	2009-07-21
Last modified	2026-06-16

Affected (3)

Vendor	Product
adobe	acrobat reader
corel	getplus download manager
nos microsystems	getplus download manager

Public exploits

Source	Title	Date
exploit-db	Adobe Acrobat 9.1.2 NOS - Local Privilege Escalation	2009-07-21
exploit-db	Adobe 9.x Related Service - 'getPlus_HelperSvc.exe' Local Privilege Escalation	2009-07-20

References

→ the Explorer · watch your stack · NVD