Use After Free Vulnerability in ActionScript 2 TextField.filters Array Property
There is a use after free vulnerability in the ActionScript 2 TextField.filters array property. When the TextField.filters array is set, Flash creates an internal array holding the filters. When the property is read, Flash iterates over this array and clones each filter. During this loop, it is possible to execute some AS2 by overriding a filter's constructor. At that moment, if the AS2 code alters the filters array, Flash frees the internal array leaving a reference to freed memory in the stack. When the execution flow resumes to the loop, a use-after-free occurs. Flash 17.0.0.169 added a flag to mitigate Issue 457278 and Flash 18.0.0.160 added an other flag to mitigate Issue 476926, but both mitigations can be bypassed.