# Adobe Flash Player MP4 Use-After-Free Vulnerability

Malformed MP4 makes Flash's frame counter thread outlive the freed NetStream, causing a use-after-free that can lead to code execution.

- Payout: $2,000
- Severity: high
- Program: Internet Bug Bounty
- Found by: hhj4ck
- Disclosed: 2015-03-11
- CVE: CVE-2014-0553
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/30567
- Library page: https://bugbountylibrary.com/r/h1%3A30567
- Tags: area:os domain:browser impact:dos impact:rce kind:bounty platform:hackerone sev:high technique:source-review vuln:dos vuln:memory-corruption

**Target:** Adobe Flash Player NetStream MP4 parser/timer thread on Windows
**Root cause:** A malformed mp4 file tricks Flash into believing the video never ends, so a standalone thread keeps updating a frame/duration counter after the page (and Flash) is freed.
**Steps:**
1. Craft a malformed mp4 that makes Flash believe the film never ends.
2. Load and play it via a NetStream object in Flash Player.
3. Close the page containing Flash, freeing Flash's memory while the counter thread keeps updating.
4. Depending on release order, either the counter memory is freed first (access freed memory) or the counter-updating code is freed first (execute freed memory), producing a crash.
**Exploitation:** A carefully crafted mp4 triggers the dangling counter thread; the resulting UAF (read or execute of freed memory) can be shaped toward code execution, though the text gives no concrete exploit chain.
**Insight:** Media players that keep a separate timing/counter thread alive past object teardown are UAF candidates: look for state that outlives the page/object lifecycle when a malformed container claims an endless stream.