CVE-2024-22915

What it actually does

Heap-use-after-free in swf_DeleteTag allows attacker-controlled memory reuse leading to arbitrary code execution when processing malformed SWF content.

Why it matters to the business

Attackers can run malicious code on systems that open untrusted files with the affected library, potentially leading to full compromise of developer workstations or build pipelines that depend on the package.

How an attack unfolds

An attacker crafts a malicious SWF file that triggers the use-after-free during tag deletion; when the vulnerable application processes the file the freed memory is reused with attacker data, resulting in code execution. The flaw has publicly available exploit code but no known ransomware or named APT campaigns.

How to fix it

Upgrade @fedify/fedify to 0.11.1 or later, or update dahlia/fedify and fedify-dev/fedify to commit 30f9cf4a175704a04c874f3ea88414c5f1e00b28. Rebuild and redeploy any applications or containers that embed the vulnerable version.

How to confirm the fix worked

Confirm the updated package version or commit is present in lockfiles and container images; run regression tests that exercise SWF parsing paths and verify absence of the use-after-free under sanitizers.

Typical attack path

1. Attacker prepares a specially crafted SWF file containing structures that trigger the use-after-free in swf_DeleteTag
2. Victim opens the file with an application linked against the vulnerable SWFTools library or a dependent package
3. The library reuses the freed heap chunk with attacker-controlled data
4. Execution flow is redirected to attacker-supplied code, achieving arbitrary code execution

How to detect it

Review process execution logs and file-open events for unexpected SWF files processed by applications using the vulnerable library; look for crashes or sanitizer reports indicating heap-use-after-free during tag deletion.

What your security team should do

• Immediately update all Fedify-based projects to the fixed versions listed
• Scan dependency graphs for any remaining references to SWFTools 0.9.2 or earlier
• Add automated dependency-update checks and SBOM generation to prevent future regressions