CVE-2022-35093

What it actually does

Global buffer overflow in DCTStream::transformDataUnit at /xpdf/Stream.cc causes memory corruption when processing malformed SWF input, resulting in denial of service.

Why it matters to the business

Processing untrusted SWF files with affected SWFTools versions can crash the application, disrupting workflows that rely on SWF conversion or analysis tools; low exploitation likelihood but exploit code is public.

How an attack unfolds

An attacker crafts a malicious SWF file containing specially malformed DCT data that triggers the overflow in transformDataUnit when parsed by SWFTools; the victim opens the file locally with an affected tool, leading to a crash due to the buffer overflow.

How to fix it

No fixed versions are listed; discontinue use of affected SWFTools commits or replace with alternative tools that handle SWF files safely. Avoid processing untrusted SWF input until a patched version is available.

How to confirm the fix worked

Confirm SWFTools version is newer than commit 772e55a2 or test with known crashing SWF samples; monitor for segmentation faults when parsing DCT-containing streams.

Typical attack path

1. Attacker generates SWF file with crafted DCT stream data to overflow the buffer
2. Attacker delivers the malicious SWF to the target via email, web, or file share
3. Victim opens the SWF using an affected SWFTools binary on their local system
4. DCTStream::transformDataUnit processes the input and overflows the global buffer
5. Application crashes, achieving denial of service

How to detect it

Review system and application logs for SWFTools crashes or segmentation faults when processing SWF files; look for unusual process terminations involving swftools binaries on systems that handle Flash content.

What your security team should do

• Block or sandbox SWFTools usage on untrusted SWF files immediately
• Scan for and inventory all deployments of SWFTools across the environment
• Replace SWFTools with maintained alternatives where possible
• Enable crash reporting and logging for any remaining SWFTools instances