CVE-2022-35104

What it actually does

Heap buffer overflow in DCTStream::reset() at Stream.cc allows out-of-bounds memory access when parsing malformed DCT streams inside SWF files, resulting in process crash or potential memory corruption.

Why it matters to the business

Local users or automated workflows that process untrusted SWF files with the affected tools may experience application crashes and service interruptions; the project shows no official fixed releases, increasing long-term exposure for organizations still relying on it.

How an attack unfolds

An attacker creates a specially crafted SWF containing a malformed DCT stream, then convinces a victim to open the file locally with an affected swftools binary; the overflow occurs during stream reset and may be leveraged for denial of service or further memory corruption.

How to fix it

Replace swftools with a maintained alternative such as pdf2svg, mutool, or Ghostscript. If continued use is required, compile from a post-772e55a2 codebase once upstream fixes are merged, or isolate the tools inside containers with no access to sensitive data.

How to confirm the fix worked

Run the affected utilities against a corpus of known-good and known-bad SWF files; confirm absence of crashes or sanitizer reports (ASAN/UBSAN) on test cases that previously triggered the overflow. Monitor project commits for any future DCTStream changes.

Typical attack path

1. Craft malicious SWF embedding oversized or malformed DCT data
2. Deliver file via email, download link, or shared storage
3. Victim executes swftools utility (pdf2swf, swfextract, etc.) on the file
4. DCTStream::reset triggers heap overflow leading to crash or corruption

How to detect it

Review process execution logs and crash dumps for swftools binaries encountering unexpected termination while processing SWF inputs; correlate with file-access timestamps on potentially malicious SWF artifacts.

What your security team should do

• Inventory all systems and CI pipelines that invoke swftools binaries and prioritize removal or replacement
• Block execution of swftools on endpoints that handle untrusted files until replacement is complete
• Add SWF file-type restrictions or sandboxing for any remaining legacy workflows