Significant Flash exploit mitigations are live in v18.0.0.209
Summary: Project Zero worked with Adobe to land exploit mitigations in Flash v18.0.0.209, including heap partitioning that moves Vector.<uint> buffer objects out of the general Flash heap and into the standard system heap, plus stronger randomization of the Flash heap. Adobe also added Vector length validation that stores lengths alongside a validation secret, so a corrupted length produces a mismatch and a runtime abort.
Bottom line: The Vector.<uint> length-corruption primitive was the go-to method behind recent Flash 0-days, including at least two of the Hacking Team 0-days, so defenders now have a concrete barrier against the technique attackers have relied on.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026