CVE-2022-35106

What it actually does

The vulnerability triggers a segmentation violation (crash) inside FoFiTrueType::computeTableChecksum when malformed input is supplied to the checksum routine.

Why it matters to the business

Untrusted SWF or PDF-derived files can cause the processing application to terminate unexpectedly, interrupting automated conversion, rendering, or analysis pipelines.

How an attack unfolds

An attacker creates a malformed file that reaches the checksum function with invalid data; when the victim opens or converts the file, the resulting memory access violation forces the process to exit.

How to fix it

No official fixed versions are published; replace or sandbox the affected binary, restrict it to trusted input only, or migrate to an alternative tool that does not use the vulnerable xpdf-derived code.

How to confirm the fix worked

Reproduce the crash with the originally reported malformed input both before and after any mitigation to confirm the fault is no longer reachable.

Typical attack path

1. Craft a file containing data that triggers the faulty checksum path
2. Deliver the file via email, download, or shared storage
3. Victim invokes an affected SWFTools utility on the file
4. Application crashes with a segmentation fault

How to detect it

Search process and system logs for segmentation faults or abrupt terminations of swftools binaries when handling user-supplied files.

What your security team should do

• Block or sandbox execution of swftools on untrusted files
• Add crash-monitoring alerts for swftools processes
• Inventory all systems that invoke swftools and prioritize removal or replacement