CVE-2022-35081

What it actually does

Heap buffer overflow in png_read_header during PNG header processing in png2swf allows out-of-bounds memory access that can crash the process.

Why it matters to the business

Users who convert PNG images to SWF files risk sudden application crashes and loss of work; the tool remains widely referenced in legacy media pipelines with no vendor patch available.

How an attack unfolds

An attacker crafts a malicious PNG file whose header triggers the overflow inside png_read_header. The victim opens the file with png2swf, causing the tool to read beyond allocated heap memory and terminate.

How to fix it

Remove or isolate the png2swf binary; replace any workflow that invokes png2swf with a maintained converter; monitor upstream commits for a corrective patch and rebuild from source once available.

How to confirm the fix worked

Run png2swf against a set of known-good and known-malformed PNG headers in a sandbox and confirm the process exits cleanly without heap diagnostics; verify the binary is no longer present in production paths.

Typical attack path

1. Attacker prepares a PNG with a malformed header sized to overflow the buffer in png_read_header.
2. Malicious PNG is delivered via email, web download, or shared storage.
3. Victim invokes png2swf on the file (directly or via automated script).
4. Overflow occurs during header parsing, resulting in process crash.

How to detect it

Search endpoint logs and crash dumps for unexpected terminations of png2swf; correlate with file-access events involving .png files immediately preceding the crash.

What your security team should do

• Inventory all systems and scripts that call png2swf and deprecate them.
• Block execution of the png2swf binary via application allow-listing.
• Add crash-monitoring rules for png2swf in endpoint telemetry.