CVE-2021-39574

What it actually does

Heap buffer overflow in pool_read() within pool.c allows out-of-bounds memory access leading to arbitrary code execution when processing a crafted SWF file.

Why it matters to the business

Attackers can achieve full control over systems that process untrusted SWF files with this tool, risking data theft, ransomware deployment, or lateral movement with no official patches available.

How an attack unfolds

An attacker creates a malicious SWF file that triggers the heap overflow during parsing in pool_read(); when a user or automated process opens the file with the affected swftools binary, the overflow is used to overwrite memory structures and execute attacker-supplied code.

How to fix it

Remove or isolate swftools installations; replace with maintained alternatives; if continued use is required, apply source-level patches that correct bounds checking in pool.c and rebuild.

How to confirm the fix worked

Verify the installed swftools version is newer than 20200710 or confirm the pool.c source contains explicit length validation before any read operations; test with known proof-of-concept SWF files in an isolated environment.

Typical attack path

1. Craft a malicious SWF file that triggers the pool_read heap overflow
2. Deliver the file via email, web download, or shared storage
3. Victim or automated workflow opens the file with an affected swftools binary
4. Overflow is triggered and attacker code gains execution

How to detect it

Review process execution logs and crash reports for swftools binaries; look for segmentation faults or heap corruption indicators referencing pool.c during SWF file handling.

What your security team should do

• Inventory all systems using swftools and remove where possible
• Block execution of swftools binaries via application allow-listing
• Scan file shares and email archives for SWF files and treat them as high risk
• Monitor for new community patches or forks that address the pool.c flaw