CVE-2015-5127

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player due to improper handling of BitmapData objects when setting the DisplacementMapFilter.mapBitmap property [2]. This allows an attacker to free a memory object and then reference it, leading to code execution. Affected versions include Flash Player before 18.0.0.232 on Windows and OS X, before 11.2.202.508 on Linux, and Adobe AIR before 18.0.0.199 [1][3].

Exploitation

An attacker can exploit this by crafting a malicious SWF file that manipulates BitmapData and DisplacementMapFilter objects. The provided reproduction case [2] involves compiling an ActionScript 2 (AS2) file, manually modifying bytes to trigger the issue, then serving the SWF via a web browser. User interaction is required (e.g., opening a web page containing the SWF). The use-after-free is triggered when the Flash player dereferences a controlled memory address [2].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running the Flash Player. This can lead to full system compromise, including data theft, installation of malware, or further network attacks. The vulnerability is classified as critical with a high CVSS score.

Mitigation

Adobe released fixed versions in August 2015: Flash Player 18.0.0.232 (Windows/OS X), 11.2.202.508 (Linux), and AIR 18.0.0.199 [1][3]. Users should update immediately. There is no known workaround. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog at the time of writing.