There is a type confusion bug when setting the codec of a Microphone object. The AVM1 call assumes the first parameter is a string, but does not verify that this is the case. If the parameter is a numeric type instead of a string, String native methods will be called on a pointer that is set by the attacker.

The issue can be reproduce by executing the following ActionScript:

flash.Lib._root._global.ASnative(2104,4).call(flash.Microphone.get(), 7777777777777777);

The method call above is equivalent to Microphone.codec = value.

A sample swf is attached.
 

m.swf 3.2 KB Download