Swftools is a compact utility suite for parsing, converting, and manipulating SWF (Flash) files, a format that sees limited but specialized use in legacy media workflows and embedded contexts. Despite a narrow product scope, the toolkit occupies a notable position in vulnerability research due to its role in processing untrusted binary formats, and its disclosures span a broad range of memory-safety classes that reflect the complexity of SWF parsing. The recurring vulnerability pattern centers on out-of-bounds access, NULL-pointer dereference, and use-after-free conditions within buffer-handling operations—flaws endemic to C-based parsers processing structurally complex binary input without modern memory protections. Defenders deploying swftools in automated conversion or media-processing pipelines should prioritize updates and apply input validation, particularly where the tool processes untrusted or user-supplied SWF files; live severity and exploitation metrics are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Swftools over time
Signals from CVEs in this vendor scope (126 CVEs).
126 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-40009CRITICAL SWFTools commit 772e55a was discovered to contain a heap-use-after-free via the function grow_unicode at /lib/ttf.c. | Sep 20, 2022 | 9.8 | 32 | NO | NO |
CVE-2022-40008CRITICAL SWFTools commit 772e55a was discovered to contain a heap-buffer overflow via the function readU8 at /lib/ttf.c. | Sep 20, 2022 | 9.8 | 31 | NO | NO |
CVE-2017-8400HIGH In SWFTools 0.9.2, an out-of-bounds write of heap data can occur in the function png_load() in lib/png.c:755. This issue can be triggered by a malformed PNG file that is mishandled | May 1, 2017 | 8.8 | 28 | NO | NO |
CVE-2017-11101HIGH When SWFTools 0.9.2 processes a crafted file in swfcombine, it can lead to a NULL Pointer Dereference in the swf_Relocate() function in lib/modules/swftools.c. | Jul 7, 2017 | 8.8 | 27 | NO | NO |
CVE-2017-9927HIGH In SWFTools 2013-04-09-1007 on Windows, png2swf allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted file, related to a "Rea | Jul 5, 2017 | 8.8 | 27 | NO | NO |
CVE-2017-9925HIGH In SWFTools 2013-04-09-1007 on Windows, png2swf allows remote attackers to execute arbitrary code or cause a denial of service via a crafted file, related to a "User Mode Write AV | Jul 5, 2017 | 8.8 | 27 | NO | NO |
CVE-2017-9924HIGH In SWFTools 2013-04-09-1007 on Windows, png2swf allows remote attackers to execute arbitrary code or cause a denial of service via a crafted file, related to a "User Mode Write AV | Jul 5, 2017 | 8.8 | 27 | NO | NO |
CVE-2010-1516HIGH Multiple integer overflows in SWFTools 0.9.1 allow remote attackers to execute arbitrary code via (1) a crafted PNG file, related to the getPNG function in lib/png.c; or (2) a craf | Aug 17, 2010 | 9.3 | 27 | NO | NO |
CVE-2017-11100HIGH When SWFTools 0.9.2 processes a crafted file in swfextract, it can lead to a NULL Pointer Dereference in the swf_FoldSprite() function in lib/rxfswf.c. | Jul 7, 2017 | 8.8 | 26 | NO | NO |
CVE-2017-11098HIGH When SWFTools 0.9.2 processes a crafted file in png2swf, it can lead to a Segmentation Violation in the png_load() function in lib/png.c. | Jul 7, 2017 | 8.8 | 26 | NO | NO |
Signals from CVEs in this vendor scope (126 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Swftools.
Media articles that mention a CVE ID that affects a product developed by Swftools — matched by CVE ID, not by vendor name.