(^Exploiting)\s*(CVE-2015-0318)\s*(in)\s*(Flash$)
Summary: Project Zero's Mark Brand documented CVE-2015-0318, a bug in the PCRE regex engine as used in Flash, where the \c escape sequence combined with a multibyte UTF-8 character compiles into invalid PCRE bytecode. By adding a back-reference, the invalid opcode 0x80 indexes past the _pcre_OP_lengths array to yield a length of 110, letting a groomed heap place attacker-controlled bytecode that find_brackets links into the regex program.
What you should know: The exploit needs only a crafted regular expression, and Brand notes Flash does not validate whether the regex compiled successfully, so a failed heap groom passes silently. A single out-of-bounds dword write past a heap allocation of at least 396 bytes was enough to start building a write primitive in a component most teams never think to patch.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2015-0318
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026