Details of the vulnerability surfaced following a cyberattack against the controversial Italian hackers-for-hire firm Hacking Team. Proof-of-concept code for exploit of the vulnerability was part of a large cache of internal information leaked by the attackers. Given the source of the proof-of-concept code, it is possible that this vulnerability has already been exploited in the wild. Following its disclosure, it can be expected that groups of attackers will rush to incorporate it into exploit kits before a patch is published by Adobe.

Analysis by Symantec has confirmed the existence of this vulnerability by replicating the proof-of-concept exploit on the most recent, fully patched version of Adobe Flash (18.0.0.194) with Internet Explorer. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected computer.

Adobe has yet to comment on the vulnerability and a patch has not yet been published. Symantec regards this vulnerability as critical since it could allow attackers to remotely run code on an affected computer, effectively allowing them to take control of it.