libming
CVE-2025-66869
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious SWF file
-
ExploitVictim tool parses file with libming 0.4.8
-
ExecutionTrigger heap overflow in strcat
-
ImpactCrash process (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that an application or tool built on libming 0.4.8 parse an attacker-supplied, maliciously crafted SWF file that drives an oversized strcat into a heap buffer. Limiting factors: the input is a file that must reach the parser, so in practice a victim must process or be fed the malicious file (user interaction or a file-ingesting service), and only version 0.4.8 is listed as affected. Impact is confined to availability (process crash); no confidentiality or integrity impact is established, and no authentication is required to supply the malformed file. |
| Impact | Signals point to a moderate, low-priority issue despite the 7.5 'High' CVSS. The input CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a remote, unauthenticated, no-interaction attack, but the only impact is availability (C:N/I:N/A:H) - i.e. a crash/DoS, not code execution or data compromise, which is consistent with CWE-122 (heap-based buffer overflow) detected via a strcat overflow. The EPSS score is low (0.33%, 25th percentile) and there is no CISA KEV listing, indicating no observed or widely predicted exploitation. Publicly available exploit code exists (the referenced libming GitHub issue #366), but POC availability is distinct from active exploitation. A key conflict to flag: the NVD vector asserts AV:N/UI:N, yet libming is a file-parsing library whose realistic trigger is a crafted SWF file processed locally by a tool or service - the network/no-interaction rating is almost certainly inherited from a generic file-parse-as-network assumption and should be verified; realistic exploitation typically requires a victim to process a malicious file. Additionally, the cited crash location 'asan_interceptors.cpp' is an AddressSanitizer runtime interceptor, not libming source, meaning the report reflects a sanitizer-detected overflow in an instrumented build - verify the underlying root cause in libming itself. |
| Exploit ScenarioDerived | An attacker crafts a malformed SWF (Flash) file that triggers a heap buffer overflow in a strcat operation when libming 0.4.8 parses it. When a victim tool, converter, or service built on libming processes the file, the overflow corrupts the heap and crashes the process, causing denial of service. Public exploit/crash-reproduction code is available via the referenced libming issue. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
A heap-based buffer overflow in libming 0.4.8 can crash applications and tools that parse attacker-supplied SWF (Flash) files, producing a denial-of-service condition with no established confidentiality or integrity impact. Per the authoritative assessment, the attack vector is best characterized as local with user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), meaning a victim or file-ingesting service must open the crafted SWF, and only version 0.4.8 is listed as affected. Publicly available exploit code exists (tracked via the libming GitHub issue), but there is no evidence of confirmed active exploitation in CISA KEV, and EPSS is low at 0.33% (25th percentile), reinforcing a moderate, low-priority risk profile despite the 7.5 'High' score reported by NVD.
RemediationAI
No vendor-released patch was identified at the time of analysis, and the libming 0.4.8 release line has not provided an official fixed version for this issue, so remediation currently depends on compensating controls. The most effective control is to prevent libming 0.4.8 from parsing untrusted SWF input: restrict file-ingesting services and any tools (for example listswf or swftophp) to trusted files only, and require explicit user confirmation before opening externally sourced SWF content - the trade-off is that this effectively disables the parser for untrusted sources and breaks automated Flash-processing workflows. Where SWF parsing of untrusted files cannot be avoided, run the parser in a sandboxed, low-privilege process with memory and CPU limits and crash-only restart behavior, accepting that the process will still abort on a malformed file but the blast radius is confined to availability. Users able to build from source can also monitor the upstream issue at https://github.com/libming/libming/issues/366 for a committed fix, and should treat any such upstream commit as an unfinalized fix until a tagged release is published; no exact patched version number should be assumed until then.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libming is a C library for reading and writing Adobe Flash (SWF) files, widely embedded in command-line utilities such as listswf, swftophp, and other parsers that ingest untrusted SWF input. The flaw is a heap-based buffer overflow (CWE-122) surfaced through the strcat function in asan_interceptors.cpp: the AddressSanitizer interceptor reports an unbounded strcat concatenation in which an attacker-controlled, oversized source string is copied into a heap buffer that was allocated too small. The root cause is therefore a missing length or bounds check in libming 0.4.8's SWF parsing path, where data derived from the malformed file reaches a string-concatenation routine without validation. Because the overflow corrupts heap memory, the practical outcome is a process abort or crash, consistent with the assessed availability-only impact (C:N/I:N/A:H) and the AV:L/AC:L/PR:N/UI:R vector requiring the malicious file to be fed into the parser.
Know when Libming gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
libming is a file-parsing library, so exploitation needs a victim to process a crafted SWF locally (AV:L, UI:R); only a crash is demonstrated (A:H, C:N/I:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
Buffer overflow vulnerability in function strcat in asan_interceptors.cpp in libming 0.4.8.
Executive ViewAI
libming 0.4.8 contains a heap-based buffer overflow that can crash applications and tools parsing attacker-supplied SWF files, resulting in denial-of-service. This vulnerability affects any system or service that processes untrusted Flash content, potentially causing operational disruptions. Although publicly available exploit code exists, there is no confirmed active exploitation (CISA KEV) and no vendor-released patch identified at time of analysis, requiring immediate mitigation to protect affected assets.
Restrict processing of untrusted SWF files, implement sandboxing for applications using libming, and monitor for crashes; consider disabling SWF parsing where not essential.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Affected Products (CPE)CVE.org
Buffer Overflow vulnerability in libming version 0.4.8, allows attackers to execute arbitrary code and obtain sensitive
Ming (aka libming) 0.4.8 has a heap-based buffer over-read (2 bytes) in the function decompileIF() in decompile.c. Rated
Ming (aka libming) 0.4.8 has a heap-based buffer over-read (8 bytes) in the function decompileIF() in decompile.c. Rated
Ming (aka libming) 0.4.8 has an out of bounds read vulnerability in the function OpCode() in the decompile.c file in lib
libming listswf 0.4.7 was discovered to contain a buffer overflow in the parseSWF_DEFINEFONTINFO() function at parser.c.
libming v0.4.8 was discovered to contain a stack buffer overflow via the function makeswf_preprocess at /util/makeswf_ut
Ming (aka libming) 0.4.8 has a heap-based buffer over-read in the function decompile_SWITCH() in decompile.c. Rated high
Ming (aka libming) 0.4.8 has an out of bounds write vulnerability in the function strcpyext() in the decompile.c file in
Ming (aka libming) 0.4.8 has a NULL pointer dereference in the function getString() in the decompile.c file in libutil.a
The readBytes function in util/read.c in libming through 0.4.8 allows remote attackers to have unspecified impact via a
The parseSWF_ACTIONRECORD function in util/parser.c in libming through 0.4.8 allows remote attackers to have unspecified
libming 0.4.8 has a NULL pointer dereference in the getName function of the decompile.c file, a different vulnerability
Exploit-DB