CVE-2024-22913

What it actually does

Heap buffer overflow in the swf5lex function at lex.swf5.c:1321 allows an attacker to corrupt memory and achieve arbitrary code execution during SWF parsing.

Why it matters to the business

Processing untrusted SWF files with the vulnerable version can lead to full system compromise, data theft, or ransomware deployment on developer or analysis workstations.

How an attack unfolds

An attacker supplies a specially crafted SWF file that overflows the heap buffer inside swf5lex when the file is lexed; with public exploit code available, the overflow is turned into code execution under the privileges of the swftools process.

How to fix it

Upgrade SWFTools to a version containing a corrected swf5lex implementation; until then, avoid processing untrusted SWF files with the tool.

How to confirm the fix worked

Confirm SWFTools version is newer than 0.9.2, run the tool against a corpus of test SWF files including known trigger cases, and verify no crashes or sanitizer violations occur.

Typical attack path

1. Attacker crafts malicious SWF file triggering the overflow
2. Victim opens or processes the file with SWFTools
3. swf5lex reads past the allocated buffer
4. Memory corruption is leveraged for code execution

How to detect it

Review process execution logs and crash reports for swftools or swf5lex; look for segmentation faults or heap error messages when SWF files are processed.

What your security team should do

• Remove or isolate SWFTools 0.9.2 installations
• Replace SWFTools usage with maintained alternatives for SWF handling
• Block untrusted SWF files at email and web gateways
• Hunt for swftools processes handling external files