Adobe Flash authplay SWF exploit in PDF — CVE-2010-1297

CVE-2010-1297 is an Adobe Flash/authplay.dll memory-corruption vulnerability exploited in the wild through malicious PDFs containing crafted SWF content plus encoded heap-spray stages. The detector requires RichMedia Flash activation, an embedded or recovered inner SWF with ActionScript prototype/AVM-era markers or AES-PHP/authplay variant markers seen in the 2010 exploit family, and shellcode staging either in the PDF or inside a bounded AS3 ByteArray/loadBytes unpacker. Ordinary RichMedia Flash documents and SWFs without the heap-spray stage are not attributed to the CVE.