CVE-2016-4230

HIGH

Adobe Flash Player <22.0.0.209 - Use After Free

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-4230. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit leverages a use-after-free vulnerability in Adobe Flash's MovieClip Transform getter. By replacing the Transform constructor with a getter via addProperty, the MovieClip is freed before access, leading to potential remote code execution.

Description

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4173, CVE-2016-4174, CVE-2016-4222, CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229, CVE-2016-4231, and CVE-2016-4248.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · textdosmultiple

https://www.exploit-db.com/exploits/40311

View Code ZIP pw:eip

This exploit leverages a use-after-free vulnerability in Adobe Flash's MovieClip Transform getter. By replacing the Transform constructor with a getter via addProperty, the MovieClip is freed before access, leading to potential remote code execution.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Adobe Flash Player (versions affected by CVE-2016-4230)

No auth needed

Prerequisites: Victim must have vulnerable Adobe Flash Player installed · Victim must visit a malicious webpage or open a malicious SWF file

MITRE ATT&CK