CVE-2022-35096

What it actually does

Heap buffer overflow in draw_stroke at gfxpoly/stroke.c allows out-of-bounds memory writes when processing malformed SWF input, resulting in memory corruption.

Why it matters to the business

Processing untrusted SWF files on affected systems can cause application crashes and denial of service; low exploitability and lack of known campaigns limit widespread operational disruption.

How an attack unfolds

An attacker creates a specially crafted SWF file that triggers the overflow condition inside draw_stroke when the file is opened or converted by SWFTools; the malformed stroke data causes the heap write during rendering.

How to fix it

Upgrade SWFTools beyond commit 772e55a2 to a version containing the fix for the heap buffer overflow in stroke.c; until a release is available, avoid processing untrusted SWF files.

How to confirm the fix worked

Confirm installed SWFTools binary or source is newer than commit 772e55a2; test with known malformed SWF samples that previously triggered the overflow and verify absence of crashes or memory errors.

Typical attack path

1. Craft SWF file containing malformed stroke data to trigger draw_stroke overflow
2. Deliver file to target via email, web, or shared storage
3. Victim or automated process opens or converts the file with vulnerable SWFTools
4. Heap corruption occurs, typically resulting in crash

How to detect it

Review application and system logs for SWFTools crashes or segmentation faults during SWF processing; look for repeated failures on specific files in file-processing workflows.

What your security team should do

• Restrict SWFTools usage to trusted files only until patched
• Monitor upstream repository for a release addressing the stroke.c issue
• Sandbox or isolate SWFTools processes that handle external files
• Replace SWFTools with alternative tools where feasible for SWF processing