CVE-2024-22912

What it actually does

Global buffer overflow in the countline function at swf5compiler.flex:327 allows an attacker to overwrite adjacent memory and achieve arbitrary code execution when processing a specially crafted SWF file.

Why it matters to the business

Successful exploitation can lead to full compromise of workstations or servers that process untrusted SWF content, resulting in data theft, ransomware deployment, or persistence by attackers.

How an attack unfolds

An attacker crafts a malicious SWF file that triggers the buffer overflow in countline during compilation or parsing; when a victim opens the file with an affected SWFTools binary, the overflow is triggered and attacker-controlled code executes with the privileges of the running process.

How to fix it

Upgrade to a patched version of SWFTools once available; until then, avoid processing untrusted SWF files with the affected tools and consider replacing SWFTools with maintained alternatives that support modern SWF parsing.

How to confirm the fix worked

Confirm SWFTools version is newer than 0.9.2 or apply the upstream fix for countline in swf5compiler.flex; test by attempting to compile a known-triggering SWF sample and verify the process does not crash or execute unexpected code.

Typical attack path

1. Craft malicious SWF file that overflows the global buffer in countline
2. Deliver the file via email, web download, or shared storage
3. Victim opens the file using an affected SWFTools binary (swfc, swfextract, etc.)
4. Overflow occurs during lexical analysis, corrupting memory and hijacking control flow
5. Attacker payload executes, establishing foothold or executing further commands

How to detect it

Review process creation and file-access logs for invocations of SWFTools binaries on unexpected or newly received SWF files; look for segmentation faults or abnormal memory behavior in swfc or related utilities around the time of file processing.

What your security team should do

• Immediately restrict use of SWFTools on systems that handle external or untrusted files
• Scan endpoints for presence of swftools 0.9.2 binaries and replace or isolate them
• Add SWFTools execution to application allow-listing policies where feasible
• Monitor for new upstream releases and apply fixes as soon as they are published