CVE-2021-42198

What it actually does

NULL pointer dereference in swf_GetBits() within rfxswf.c triggers a crash when parsing malformed SWF input, resulting in denial of service.

Why it matters to the business

Processing of untrusted SWF files can halt automated workflows or services that rely on swftools, causing operational downtime until the affected process is restarted.

How an attack unfolds

An attacker crafts a malformed SWF file that triggers the NULL dereference in swf_GetBits(). The victim opens or processes the file locally with swftools, causing the application to crash and become unavailable.

How to fix it

No fixed versions are published; discontinue use of swftools on untrusted input, replace with alternative SWF parsers, or apply custom patches that validate input before calling swf_GetBits().

How to confirm the fix worked

Attempt to process known-malformed test SWF files with the updated or replaced parser and confirm the process no longer crashes; monitor for absence of segmentation faults in logs.

Typical attack path

1. Attacker generates a specially crafted SWF file containing data that reaches swf_GetBits() with a NULL pointer.
2. Attacker delivers the file via email, web download, or shared storage.
3. Victim or automated system invokes a swftools utility on the file.
4. swf_GetBits() dereferences NULL, crashing the process and denying service.

How to detect it

Review process crash logs and core dumps for segmentation faults originating from rfxswf.c or swf_GetBits(); correlate with recent SWF file access in user or service histories.

What your security team should do

• Immediately restrict swftools execution to trusted files only.
• Replace swftools with maintained libraries or tools that handle SWF parsing safely.
• Add SWF file handling to the list of high-risk file types requiring sandboxing or blocking.