Taming the wild copy: Parallel Thread Corruption

Summary: Project Zero's Chris Evans described a 2014-fixed Flash vulnerability (issue 122) in which the G711 sound codec is broken on some platforms and always produces a wild copy, triggering a heap memmove() with a small negative length. The exploit uses 'parallel thread corruption' - abusing side effects in one thread of an asynchronous corruption in another - to corrupt a Vector.<uint> buffer header, defeat ASLR, and rewire GOT/PLT pointers so munmap() calls system().
Why it matters: The exploit needed no secondary bug: it won a race against a copy moving at roughly 10 gigabytes per second, and by the time the payload stopped Chrome the wild copy thread had already moved 50MB of memory - so a crash-on-corruption assumption is not a mitigation.

Read the original at Google Project Zero ↗

Topics: Endpoint & Network Security
Related: Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026
Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026
Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026