CVE-2012-1535 in Flash Player
Summary
by MITRE
Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content, as exploited in the wild in August 2012 with SWF content in a Word document.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/22/2026
Adobe Flash Player versions prior to 11.3.300.271 on Windows and Mac OS X and 11.2.202.238 on Linux contained a critical vulnerability that enabled remote code execution and denial of service attacks through malicious SWF content. This vulnerability was actively exploited in the wild during August 2012 when attackers embedded malicious SWF files within Microsoft Word documents to deliver payloads. The flaw manifested as a memory corruption issue that occurred when Flash Player processed specially crafted SWF files, allowing attackers to manipulate memory layout and execute arbitrary code on affected systems. The vulnerability was classified as a buffer overflow or heap corruption issue that could be triggered through the Flash Player's handling of malformed SWF content, which is a common attack vector in the exploitation of multimedia player vulnerabilities. The attack typically began with a user opening a malicious Word document containing an embedded SWF file, which would then be processed by Flash Player and trigger the memory corruption. This vulnerability directly relates to CWE-125, which describes out-of-bounds read conditions, and CWE-787, which covers out-of-bounds write conditions, both of which are common in multimedia processing applications. The exploitation technique aligned with ATT&CK tactic TA0002 (execution) and technique T1203 (exploitation for client execution), demonstrating how attackers leveraged document-based delivery methods to execute malicious code through Flash Player. The impact was severe as successful exploitation could result in full system compromise, allowing attackers to execute commands with the privileges of the Flash Player process, typically running with user-level permissions. The vulnerability affected a wide range of operating systems including Windows, Mac OS X, and Linux platforms, making it a particularly dangerous exploit due to its cross-platform nature. The attack vector involved social engineering through document manipulation, where users would unknowingly execute malicious SWF content through Office applications that automatically launched Flash Player when encountering embedded content. This particular vulnerability was part of a larger trend of attacks targeting Flash Player due to its widespread installation and known exploitation patterns. The Flash Player's handling of SWF files included parsing mechanisms that failed to properly validate input data, leading to memory corruption that attackers could leverage to inject and execute malicious code. The exploitation required minimal user interaction beyond opening the malicious document, making it particularly effective for phishing campaigns and targeted attacks. Security researchers noted that the vulnerability was actively exploited in the wild, indicating that attackers had developed working exploits before the vulnerability was publicly disclosed. The remediation required immediate patching of Flash Player installations, with Adobe releasing version 11.3.300.271 for Windows and Mac OS X and 11.2.202.238 for Linux to address the memory corruption issue. Organizations had to implement comprehensive patch management procedures and consider disabling Flash Player in environments where it was not essential for business operations. The vulnerability highlighted the risks associated with rich media content processing and the importance of validating all user-supplied content in multimedia applications. This incident demonstrated how attackers could leverage document-based delivery methods to bypass traditional security controls and exploit vulnerabilities in widely deployed software components. The attack pattern represented a common technique in advanced persistent threat campaigns where attackers used multiple attack vectors to establish initial compromise and maintain access to target systems.