CVE-2022-35098

What it actually does

Heap-buffer overflow in GfxICCBasedColorSpace::getDefaultColor at xpdf/GfxState.cc allows out-of-bounds memory writes when processing malformed color space data in SWF files.

Why it matters to the business

Processing untrusted SWF files can cause application crashes and denial of service; the vulnerability has been public for over four years with public exploits available, increasing risk for any remaining deployments.

How an attack unfolds

An attacker crafts a malicious SWF file containing malformed ICC-based color space data. When a user or automated process opens the file with an affected SWFTools binary, the overflow is triggered during color space handling, leading to memory corruption and potential crash.

How to fix it

No fixed versions are published; discontinue use of SWFTools on untrusted input or rebuild from a post-772e55a2 codebase after applying upstream memory-safety fixes to the xpdf-derived color space handling.

How to confirm the fix worked

Confirm exposure by inspecting the binary for the vulnerable GfxICCBasedColorSpace::getDefaultColor symbol and testing with known crashing SWF samples; verify remediation by confirming absence of the overflow path in rebuilt binaries.

Typical attack path

1. Craft malicious SWF embedding malformed GfxICCBasedColorSpace data
2. Deliver the file via email, web download, or shared storage
3. Victim opens the file using an affected swftools utility
4. GfxState.cc triggers heap overflow during getDefaultColor processing
5. Resulting memory corruption causes denial of service

How to detect it

Review process execution logs and file-access telemetry for swftools binaries opening SWF files from untrusted sources; look for repeated crashes or segmentation faults correlated with SWF processing in system logs.

What your security team should do

• Immediately restrict SWFTools execution to trusted files only
• Replace SWFTools workflows with maintained alternatives that handle SWF content safely
• Monitor EPSS and exploit repositories for any increase in weaponization given the four-year public exposure