Three bypasses and a fix for one of Flash's Vector. mitigations
Summary: Project Zero's Chris Evans documented three ways to bypass Adobe's Flash Vector.<*> length-checking mitigation, which XORs the length with a secret cookie fetched through a pointer stored in the Vector header. The bypasses - heap spraying in a 32-bit address space, fixed-address mappings like Windows User Shared Data and Linux vsyscall, and a partial pointer overwrite on 64-bit Linux - were addressed in Flash 18.0.0.232 by moving the cookie into static BSS and enabling Vector heap partitioning on all platforms.
Bottom line: The mitigation's own design gave a buffer overflow control of every value it checked - length, XOR'd length, and the pointer to the cookie - so a single overflow could satisfy the assertion. Adobe's fix moved the cookie to static BSS, but the episode shows a defense can ship, be scrutinized, and need rework before it holds.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026