Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-e7t4-rgaz-4uec
Vulnerability ID VCID-e7t4-rgaz-4uec
Aliases CVE-2009-3869
Summary Multiple vulnerabilities in the Sun JDK and JRE allow for several attacks, including the remote execution of arbitrary code.
Status Published
Exploitability 2.0
Weighted Severity 0.7
Risk 1.4
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.78477 https://api.first.org/data/v1/epss?cve=CVE-2009-3869
epss 0.78477 https://api.first.org/data/v1/epss?cve=CVE-2009-3869
epss 0.78477 https://api.first.org/data/v1/epss?cve=CVE-2009-3869
epss 0.78477 https://api.first.org/data/v1/epss?cve=CVE-2009-3869
epss 0.78477 https://api.first.org/data/v1/epss?cve=CVE-2009-3869
epss 0.78477 https://api.first.org/data/v1/epss?cve=CVE-2009-3869
epss 0.78477 https://api.first.org/data/v1/epss?cve=CVE-2009-3869
epss 0.78477 https://api.first.org/data/v1/epss?cve=CVE-2009-3869
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-3869.json
https://api.first.org/data/v1/epss?cve=CVE-2009-3869
530062 https://bugzilla.redhat.com/show_bug.cgi?id=530062
CVE-2009-3869;OSVDB-59710 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/16298.rb
CVE-2009-3869;OSVDB-59710 Exploit http://www.zerodayinitiative.com/advisories/ZDI-09-078/
GLSA-200911-02 https://security.gentoo.org/glsa/200911-02
RHSA-2009:1560 https://access.redhat.com/errata/RHSA-2009:1560
RHSA-2009:1571 https://access.redhat.com/errata/RHSA-2009:1571
RHSA-2009:1584 https://access.redhat.com/errata/RHSA-2009:1584
RHSA-2009:1643 https://access.redhat.com/errata/RHSA-2009:1643
RHSA-2009:1647 https://access.redhat.com/errata/RHSA-2009:1647
RHSA-2010:0043 https://access.redhat.com/errata/RHSA-2010:0043
USN-859-1 https://usn.ubuntu.com/859-1/
Data source Exploit-DB
Date added Sept. 20, 2010
Description Sun Java - JRE AWT setDiffICM Buffer Overflow (Metasploit)
Ransomware campaign use Known
Source publication date Sept. 20, 2010
Exploit type remote
Platform multiple
Source update date March 7, 2011
Source URL http://www.zerodayinitiative.com/advisories/ZDI-09-078/
Data source Metasploit
Description This module exploits a flaw in the setDiffICM function in the Sun JVM. The payload is serialized and passed to the applet via PARAM tags. It must be a native payload. The effected Java versions are JDK and JRE 6 Update 16 and earlier, JDK and JRE 5.0 Update 21 and earlier, SDK and JRE 1.4.2_23 and earlier, and SDK and JRE 1.3.1_26 and earlier. NOTE: Although all of the above versions are reportedly vulnerable, only 1.6.0_u11 and 1.6.0_u16 on Windows XP SP3 were tested.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source publication date Nov. 4, 2009
Platform OSX,Windows
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/browser/java_setdifficm_bof.rb
There are no known vectors.
Exploit Prediction Scoring System (EPSS)
Percentile 0.99026
EPSS Score 0.78477
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:04:28.947918+00:00 Gentoo Importer Import https://security.gentoo.org/glsa/200911-02 38.0.0