← All detection heuristics · CVE
critical
CVE likely
CVE_2010_1297
What it means
PDF embeds a Flash SWF (RichMedia) and its de-obfuscated JavaScript heap-sprays to groom memory for the Flash exploit.
Why it fires
CVE-2010-1297 is an Adobe Flash / authplay.dll memory-corruption vulnerability exploited through PDFs that embed a crafted SWF and use JavaScript to heap-spray the process before the Flash object loads. The detector reports when an embedded Flash SWF co-occurs with a JavaScript heap-spray recovered after de-obfuscating the evasions these kits use — space-padded %u tokens, split unescape, and fromCharCode/\u spray builders inside a grooming loop — which defeat the raw %u0c0c/%u9090 heap-spray rules. Benign interactive Flash PDFs (sound players, text widgets) carry no spray and are not attributed.
Other CVE heuristics
CVE_2026_34621_RELATED CVE_2023_26369 CVE_2026_34621 CVE_2010_1297_FLASH_RICHMEDIA CVE_2010_1297_SWF_TRIGGER CVE_2011_0611_SWF_TRIGGER CVE_2009_1862_FLASH_RICHMEDIA CVE_2010_2883 CVE_2018_4901 CVE_2009_3459 CVE_2018_4990_JPX_EMBEDDED_CMD CVE_2018_4990_JPX_CMAP_TRIGGER CVE_2010_1240 CVE_2010_0188 CVE_2014_0514 CVE_2013_3346 CVE_2013_0640 CVE_2010_3654_FLASH_RICHMEDIA CVE_2007_5020_MAILTO_MSHTA CVE_2014_0496 CVE_2008_2551 CVE_2021_40444 CVE_2006_4694 CVE_2008_0118