CVE-2022-35099

What it actually does

Stack-based buffer overflow in ImageStream::getPixel allows an attacker-supplied image stream to corrupt the call stack, resulting in an immediate process crash (denial of service).

Why it matters to the business

Automated or user-initiated processing of untrusted SWF or PDF-derived files can cause the swftools utilities to terminate unexpectedly, interrupting workflows that depend on reliable file conversion or inspection.

How an attack unfolds

An attacker crafts a malicious image stream inside an SWF or PDF file that triggers the vulnerable getPixel path; when the victim opens or converts the file with any swftools binary, the overflow occurs on the stack and crashes the process.

How to fix it

Upgrade to a patched build of swftools that contains the fix for the stack overflow in Stream.cc; if no official release is available, apply the upstream commit that bounds the pixel buffer access or discontinue use of the affected utilities on untrusted input.

How to confirm the fix worked

Re-run the affected swftools binaries against a known-triggering test file and confirm the process no longer crashes; monitor build logs or source history for the corrected getPixel implementation.

Typical attack path

1. Attacker prepares a specially malformed image stream within an SWF or PDF container.
2. Victim receives the file via email, download, or shared storage.
3. Victim invokes a swftools utility (pdf2swf, swfextract, etc.) on the file.
4. ImageStream::getPixel reads attacker-controlled data, overflows the stack, and aborts the process.

How to detect it

Review process-crash logs, core dumps, or security event logs for sudden termination of swftools binaries when handling SWF or PDF files; correlate with file-creation or download events immediately preceding the crash.

What your security team should do

• Block or sandbox all swftools usage on untrusted files until a fixed build is deployed.
• Add the vulnerable utilities to application allow-lists only after verifying the patch.
• Scan historical build and CI logs for any retained copies of the vulnerable commit.