CVE-2024-22913

Vulnerability

A heap-buffer-overflow vulnerability exists in SWFTools v0.9.2 in the swf5lex() function within lib/lex.swf5.c at line 1321 [1]. This occurs when processing a specially crafted SWF file using the swfc tool. The overflow is a write of size 1 to a heap buffer, triggered during lexing of the input file.

Exploitation

An attacker can trigger the overflow by supplying a malicious SWF file to the swfc utility [1]. No authentication is required; the user must only open the crafted file with swfc. The overflow occurs in the lexer, leading to an out-of-bounds write that can be leveraged for code execution.

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running swfc. This can lead to full compromise of the affected system, including data theft, modification, or further propagation.

Mitigation

As of the publication date, no official patch has been released. The SWFTools project appears to be unmaintained (last commit 772e55a2). Users should avoid processing untrusted SWF files with swfc. No workaround is available.