CVE-2024-22914

What it actually does

Heap use-after-free in the input function at lex.swf5.c:2620 allows an attacker-supplied SWF file to trigger memory corruption resulting in denial of service.

Why it matters to the business

An attacker who supplies a malicious file can crash the affected process, interrupting any service or workflow that depends on parsing untrusted SWF content and forcing restarts or failover.

How an attack unfolds

An attacker crafts a malformed SWF file that triggers the use-after-free during lexical analysis; the file is opened locally or supplied to any application using the vulnerable parser, causing the process to crash.

How to fix it

Upgrade to a build containing commit 876899be4bb347b00a2f697e776bc844f1afbcb3 or later; rebuild any packages that statically link the vulnerable SWFTools code; replace or remove SWF parsing functionality where feasible.

How to confirm the fix worked

Confirm the installed binary or library no longer contains the vulnerable lex.swf5.c:2620 code path; run regression tests with known trigger files and verify the process does not crash; monitor vendor changelogs for the referenced commit.

Typical attack path

1. Attacker creates or modifies an SWF file to exercise the vulnerable code path in lex.swf5.c
2. Victim or automated process opens the file with the affected SWFTools component
3. Use-after-free occurs during input processing, resulting in immediate crash or memory corruption
4. Service or application becomes unavailable until restarted

How to detect it

Review process crash logs and core dumps for references to lex.swf5.c or SWFTools; look for repeated restarts of processes that handle SWF input; correlate file-access timestamps of SWF files with crash events.

What your security team should do

• Apply the fixed commit or newer build immediately on all systems that parse SWF files
• Inventory dependencies to identify any downstream packages still shipping the vulnerable SWFTools code
• Disable or sandbox SWF parsing if the functionality is not required
• Add file-type validation and sandboxing for any remaining SWF processing workflows