Use-after-free Vulnerability in Adobe Flash Player

A use-after-free vulnerability exists in Adobe Flash Player versions 17.0.0.188 and earlier. The vulnerability is caused by a non-deterministic condition that can lead to a crash when accessing memory after it has been freed. This can be exploited to execute arbitrary code by tricking a user into opening a specially crafted SWF file.

Mitigation:

Upgrade to the latest version of Adobe Flash Player.

Source

Exploit-DB raw data:

Source: https://code.google.com/p/google-security-research/issues/detail?id=398&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

The attached sample, signal_sigsegv_7ffff603deef_1525_268381c02bc3b05c84578ebaeafc02f0.swf, typically crashes in this way on my Linux x64 build (Flash v17.0.0.188):

=> 0x00007f693155bf58:	mov    (%rdi),%rbx
rdi            0x23c	572

At first glance this might appear to be a NULL dereference but sometimes it crashes trying to access 0xc8 and different builds have shown crashes at much wilder addresses, so there is probably a use-after-free or other non-deterministic condition going on. For example, our fuzzing cluster saw a crash at 0x400000001.

The base sample from which the fuzz case is derived is also attached.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37868.zip