CVE-2022-35094

What it actually does

Heap buffer overflow in DCTStream::readHuffSym when parsing malformed DCT Huffman tables inside SWF files, leading to out-of-bounds memory access and potential process crash or memory corruption.

Why it matters to the business

Processing untrusted SWF files with the affected tool can cause denial of service and may enable local code execution on developer or analyst workstations; the issue remains unpatched in public releases and affects any workflow that still relies on the legacy binary.

How an attack unfolds

An attacker supplies a specially crafted SWF containing a malicious DCT stream; when the victim opens the file with any SWFTools utility that invokes the xpdf-derived DCT decoder, the overflow is triggered during Huffman symbol decoding.

How to fix it

Replace SWFTools with a maintained alternative or compile from a post-772e55a2 tree that removes the vulnerable DCT path; sandbox or disable the tool for untrusted input; monitor upstream for any eventual security release.

How to confirm the fix worked

Confirm the binary still contains the exact DCTStream::readHuffSym symbol at the reported offset; test with known trigger files and verify absence of crash after replacement or removal.

Typical attack path

1. Craft SWF containing oversized or malformed DCT Huffman table
2. Deliver file via email, web download, or shared storage
3. Victim opens file with swftools utilities (swfextract, swfrender, etc.)
4. DCTStream::readHuffSym performs out-of-bounds write/read
5. Process crashes or attacker-controlled memory state is reached

How to detect it

Look in process execution logs, crash reports, and file-access telemetry for invocations of swftools utilities against externally sourced SWF files; correlate with heap-related crashes in the xpdf/Stream.cc code path.

What your security team should do

• Inventory all systems and CI pipelines that invoke swftools binaries
• Block or quarantine untrusted SWF files from reaching those hosts
• Remove or replace the package; do not rely on the unpatched commit
• Add SWF file-type restrictions in mail gateways and file scanners