Adobe Flash Player IExternalizable.writeExternal Type Confusion Remote Code Execution Vulnerability (CVE-2015-7645)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2015-7645) is a critical Type Confusion vulnerability residing within the ActionScript Virtual Machine (AVM2) of Adobe Flash Player. The root cause lies in the improper validation of object types during serialization/deserialization processes when the writeExternal method of the IExternalizable interface is invoked. This lack of type safety allows an attacker to force the engine to treat an object of one type as another, leading to arbitrary memory access and pointer manipulation.

2. Exploitation Mechanics & Attack Scenario

An attacker crafts a malicious SWF file containing a custom ActionScript class that implements the IExternalizable interface and overrides the writeExternal method. When a victim opens a compromised website or an email attachment containing this SWF file, the Flash Player engine processes the object, triggering the type confusion. This grants the attacker read/write primitives over the process memory space, allowing them to bypass security mitigations (such as DEP/ASLR) and execute arbitrary shellcode within the context of the browser or Flash process. This vulnerability was actively exploited in the wild by APT groups like 'Pawn Storm'.

3. Infrastructure & Business Impact

With a CVSS score of 7.8 (High), an EPSS score of 0.6534, and its inclusion in the CISA KEV catalog, this vulnerability poses a severe threat to legacy environments. Successful exploitation can lead to complete compromise of the user's workstation, serving as an initial entry point for lateral movement within corporate networks. This can result in sensitive data exfiltration, ransomware deployment, and significant operational disruption.