CVE-2022-35090

What it actually does

Heap buffer overflow during memcpy in SWFTools allows memory corruption when processing a malformed input file, resulting in application crash or potential arbitrary code execution.

Why it matters to the business

Users running unpatched SWFTools on local systems risk denial of service or system compromise when opening crafted files, with elevated urgency for environments relying on the tool for document or media workflows.

How an attack unfolds

An attacker crafts a malicious SWF file that triggers the overflow during parsing; the victim opens the file locally with an affected SWFTools binary, causing the memcpy to corrupt heap memory and potentially allowing code execution or crash.

How to fix it

Upgrade to a patched version of SWFTools once available; in the interim avoid processing untrusted files with the affected commit or build and consider alternative tools for SWF handling.

How to confirm the fix worked

Confirm the installed SWFTools binary is newer than commit 772e55a2 and test against known crashing inputs; monitor upstream repository for security fixes and rebuild from verified source.

Typical attack path

1. Attacker creates malicious SWF file exploiting the buffer overflow
2. Attacker delivers the file via email, download, or shared storage
3. Victim opens the file using an affected SWFTools utility
4. Heap overflow occurs during memcpy, leading to crash or exploitation

How to detect it

Review process crash logs and memory dumps for heap corruption patterns when SWFTools processes SWF files; correlate file access timestamps with application faults in system logs.

What your security team should do

• Block or sandbox execution of SWFTools on untrusted inputs until patched
• Inventory systems using SWFTools and prioritize updates
• Implement file-type restrictions and user training on handling SWF files