CVE-2010-2174¶

Vulnerability is a large (becomes negative) variable length argument to OP_newfunction, which somewhere is interpreted as unsigned, causing a memory write loop to hit the guard page at the end of mapped memory.

Trigger available as source:CVE-2010-2174/CVE-2010-2174_FileOffset_0xFF5_newfunction_by_FX.swf