CVE-2024-22955

What it actually does

Stack buffer underflow in the parseExpression function allows out-of-bounds memory reads/writes during expression parsing of untrusted input, enabling memory corruption that can lead to arbitrary code execution.

Why it matters to the business

Compromise of developer or analyst workstations that process untrusted SWF files can result in full system takeover, data theft, or ransomware deployment; the tool sees limited but targeted use in legacy media workflows with no vendor patch available.

How an attack unfolds

An attacker crafts a malicious SWF file containing a malformed expression that triggers the underflow when processed by swfc; the victim opens or converts the file locally, and the resulting memory corruption is leveraged for code execution without needing elevated privileges.

How to fix it

No official fixed version is published; discontinue use of swftools 0.9.2, replace with alternative SWF tooling, or rebuild from a patched upstream source if a community fix becomes available.

How to confirm the fix worked

Confirm the parseExpression function at swftools/src/swfc.c:2576 is no longer reachable with untrusted input by testing with known crashing samples and verifying the binary no longer exhibits the underflow via address sanitizer or similar instrumentation.

Typical attack path

1. Attacker prepares malicious SWF with crafted expression targeting parseExpression
2. Victim opens or converts the file using swftools on a local system
3. Underflow occurs during parsing, corrupting stack memory
4. Attacker payload achieves arbitrary code execution

How to detect it

Review process execution logs and crash reports for swfc or swftools binaries handling unexpected input; look for segmentation faults or abnormal memory access patterns during SWF parsing.

What your security team should do

• Immediately remove swftools 0.9.2 from build pipelines and analyst workstations
• Block execution of swfc and related binaries via application allow-listing
• Scan historical artifacts and logs for swftools usage to identify exposed systems
• Monitor for community patches and evaluate migration to maintained SWF libraries