From inter to intra: gaining reliability
Summary: Project Zero's Chris Evans described a technique for exploiting Adobe Flash bug 324 by associating a shader parameter from one program with a different program, producing an intra-chunk corruption rather than the inter-chunk corruption used in the series' first post. The corrupted ternary opcode's SRC_REG_2 field is then used as an out-of-bounds read within a single heap chunk to leak a vtable value, which Evans reports is 100% deterministic across Linux x64, Windows 8.1 x64, and Windows 7 x86.
What you should know: A vtable leak is the first step toward defeating ASLR, and Evans reports the recovery never changes and never crashes regardless of other Flash process activity - a reliable primitive that gets an attacker closer to the arbitrary code execution the series had only achieved unreliably before.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026