The vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Shockwave Player when a user visits a malicious website. The specific flaw exists within the handling of the ShockwaveVersion method. By passing an overly long string to this function an attacker can corrupt memory in such a way that when the method returns it will reference invalid memory. An attacker can leverage this vulnerability to execute code under the context of the user running the browser.