CVE-2022-35109

What it actually does

Heap buffer overflow in draw_stroke at gfxpoly/stroke.c when processing malformed SWF input, resulting in memory corruption with high availability impact.

Why it matters to the business

Processing untrusted files can crash the application and interrupt workflows that rely on SWF conversion or rendering, with public exploits available and no patches released after more than four years.

How an attack unfolds

An attacker crafts a malicious SWF file that triggers the overflow during stroke drawing. When the victim processes the file locally with SWFTools, the heap corruption occurs; public exploit code exists but requires user interaction and has not been observed in ransomware or named APT campaigns.

How to fix it

No fixed versions are available; replace or isolate SWFTools usage, sandbox all file processing, and avoid handling untrusted SWF input until a community patch is published.

How to confirm the fix worked

Test SWFTools against known-good and malformed SWF samples in an isolated environment; monitor upstream commit history for any fix to gfxpoly/stroke.c and re-verify crash behavior after updates.

Typical attack path

1. Craft malicious SWF file to trigger overflow in stroke.c
2. Deliver file to target user or system
3. Victim opens or processes the file with affected SWFTools utilities
4. Heap overflow executes leading to crash or potential code execution

How to detect it

Review application and system logs for segmentation faults or abnormal exits in SWFTools processes during SWF handling; correlate with file-processing timestamps to identify suspicious inputs.

What your security team should do

• Immediately restrict or disable SWFTools on untrusted inputs
• Implement application sandboxing or file-type gateways for any remaining usage
• Track community forks or patches and plan migration to maintained alternatives