CVE-2022-35097

What it actually does

A segmentation violation occurs in FoFiTrueType::writeTTF during processing of malformed TrueType font data embedded in SWF files, resulting in memory corruption that crashes the application.

Why it matters to the business

Workloads that convert, inspect, or manipulate SWF files can be disrupted by crashes when encountering malicious or malformed input, affecting legacy media pipelines with no available patches.

How an attack unfolds

An attacker creates an SWF file containing a malformed TrueType font table and supplies it to a target system running the vulnerable SWFTools binary; when the tool invokes FoFiTrueType::writeTTF the malformed data triggers a segmentation fault, and public exploits for this crash are available.

How to fix it

Upgrade SWFTools to a release that resolves the writeTTF memory corruption; where no fixed version exists, isolate or sandbox all file-processing workflows and avoid handling untrusted SWF input.

How to confirm the fix worked

Test the affected swftools binaries against known crashing samples and confirm absence of segmentation faults; monitor upstream commits for patches addressing FoFiTrueType.cc.

Typical attack path

1. Craft SWF containing malformed TrueType font tables
2. Deliver the file to a system using SWFTools
3. Invoke swftools utilities on the malicious file
4. Trigger segmentation violation and application crash

How to detect it

Search process and system logs for segmentation faults originating from swftools binaries during font or SWF handling; correlate with file-access events involving untrusted SWF or TTF content.

What your security team should do

• Treat untrusted SWF processing as high-risk until a patch is released
• Implement sandboxing or input filtering for all swftools invocations
• Review and restrict legacy media-conversion jobs that rely on this library