Life After the Isolated Heap
Summary: Project Zero's Natalie Silvanovich analyzed how Adobe's Isolated Heap, which partitions Flash's MMgc heap into three areas to separate objects likely to contain corruption bugs from objects useful for exploiting them, affected exploitability of two bugs found after its implementation. She reported CVE-2016-0998, an uninitialized variable in a fix to an ActionScript 2 use-after-free, to Adobe on February 3, 2016 (patched March 10), and CVE-2016-0984, a use-after-free in sound processing, on January 11, 2016 (patched February 16).
What's compelling: The Isolated Heap blocked Silvanovich's preferred path of reallocating a script-controlled byte buffer into a pointer-bearing object, because all script-controllable byte buffers land in partition 3, which holds no other pointer-containing types - forcing her to chain a second bug, CVE-2016-0984, to break ASLR.
Read the original at Google Project Zero ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2016-0998
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026