libming
CVE-2025-66877
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious SWF file
-
ExploitDeliver file to libming-based tool
-
ExecutionTrigger stack buffer overflow in dcputchar
-
ImpactCrash process (potential code execution)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to parse or decompile an attacker-supplied, crafted SWF file using a libming 0.4.8 tool/library that reaches the dcputchar function in decompile.c (e.g. SWF decompilation/dump utilities). It is not a listening network service despite the AV:N rating, so it depends on tricking a user or an automated file-processing pipeline into opening the malicious file. Limiting factors: the product is obscure and effectively retired (Flash/SWF), confined to version 0.4.8, and the demonstrated impact is denial of service (process crash) rather than confirmed remote code execution. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) models a remote, unauthenticated, low-complexity attack with high availability impact and no confidentiality/integrity impact. This network vector should be treated with skepticism: libming is a file-processing library/toolkit (its decompile.c powers decompiler utilities such as swftophp), and buffer overflows of this class are realistically triggered by feeding a crafted SWF file to a local tool, not over a network socket - CVSS indicates network vector but the product/function implies local file parsing, so verify the actual delivery path. A public exploit reference exists (the libming GitHub issue tracker), so 'publicly available exploit code exists,' but there is NO CISA KEV listing and NO EPSS score in the input, so there is no evidence of active exploitation and no modeled exploitation probability to weigh. The impact is also scoped to availability only (A:H), i.e. a crash/DoS, even though CWE-121 stack-based overflows can sometimes escalate to code execution; NVD appears to have conservatively rated this as DoS. Net assessment: this is a low real-world priority - a DoS in an obscure, effectively end-of-life Flash tooling library with a POC but no sign of exploitation and a questionable network vector - rather than a genuine high-severity remote threat despite the 7.5 score. |
| Exploit ScenarioDerived | An attacker crafts a malformed SWF (Flash) file with structures that overflow a stack buffer in the dcputchar routine of decompile.c, then distributes it to a victim or an automated pipeline that decompiles/parses SWF files using libming 0.4.8. When the file is processed, the overflow corrupts the stack and crashes the tool (DoS), with a theoretical possibility of code execution. Public exploit/crash-reproduction material is referenced in the libming issue tracker, lowering the barrier to triggering the bug. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
A stack-based buffer overflow in dcputchar() in decompile.c of libming 0.4.8 lets an attacker crash a tool that decompiles SWF (Flash) files, producing a denial-of-service condition in whatever process runs the libming decompilation code path. While the published CVSS 3.1 vector (7.5, AV:N/PR:N/UI:N) frames this as a remote, unauthenticated, low-complexity attack, our assessment treats it as a local, user-interaction scenario (AV:L/UI:R) because libming is a library and associated file-processing toolkit rather than a network service: the attacker must deliver a crafted SWF file that a victim or an automated pipeline opens with a libming 0.4.8 decompiler. Publicly available exploit code exists (a linked upstream GitHub issue with reproducer), confirmed active exploitation (CISA KEV) has not been observed, and the demonstrated impact is limited to availability, with no demonstrated confidentiality or integrity loss and no confirmed remote code execution.
RemediationAI
No vendor-released patch was identified at the time of analysis, and the only public reference supplied is the upstream issue at https://github.com/libming/libming/issues/367, so there is no confirmed fixed version to upgrade to - check that issue thread and any libming fork or distribution package for a patched 0.4.8 build before assuming the source distribution is remediable. Until a fix is confirmed, apply compensating controls that match the file-parsing nature of the bug: never run libming-based decompilers or dump utilities on untrusted SWF files, and where SWF analysis is still required, perform it in a disposable container or sandbox with an unprivileged account, no network access, a hard file-size/iteration limit, and a short timeout, which converts a stack corruption into a contained crash at the cost of manual isolation effort. Because the demonstrated impact is availability only, disabling or removing the decompilation tooling (rather than the whole libming library, if other unused features are needed) removes the vulnerable dcputchar() path but breaks SWF-to-text workflows; conversely, keeping the feature active behind sandboxing preserves functionality at the price of ongoing operational discipline, and since the release is effectively retired, migrating to a maintained SWF/Flash parsing library is the more durable long-term option.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libming is an open-source C library and toolset for reading, manipulating and generating Macromedia/Adobe SWF (Shockwave Flash) files, and decompile.c is part of the code path used when libming's tooling turns a parsed SWF byte stream back into a textual/action-oriented representation. In that routine, dcputchar() writes characters into a fixed-size stack buffer without validating the length of the data copied, which is a classic missing-bounds-check error classified as CWE-121 (stack-based buffer overflow). When a crafted SWF supplies more data than the destination buffer can hold, the write overflows adjacent stack memory, corrupting the stack frame and typically terminating the process; the analysis does not establish a controlled overwrite that would support code execution, so the reliable outcome is a crash. The affected component is pinned by CPE to cpe:2.3:a:libming:libming:0.4.8, meaning the defect is tied to that specific released version of the library rather than to a vendor-hosted service, and any downstream packaging that still bundles libming 0.4.8 inherits the flaw. The technology itself (SWF/Flash parsing) is obsolete and the project is effectively retired, which limits real-world exposure but also means the attacker-controlled input surface is any libming-based decompilation or dump utility processing an untrusted .swf file.
Know when Libming gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Triggered by feeding a crafted SWF file to a local tool, so AV:L and UI:R; no privileges needed, and impact observed is a crash so only A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
Buffer overflow vulnerability in function dcputchar in decompile.c in libming 0.4.8.
Executive ViewAI
The libming 0.4.8 SWF decompilation library contains a stack-based buffer overflow in its dcputchar() function that can crash any process decompiling a crafted SWF file, creating a denial-of-service risk for teams and automated pipelines handling untrusted Flash content. Publicly available exploit code exists, but the demonstrated impact is limited to availability, with no confirmed remote code execution, data theft, or integrity loss. Leadership should care because affected decompilation workflows could be interrupted, though the risk is primarily operational and can be contained through isolation and input controls.
No vendor-released patch identified at time of analysis. Interim mitigations include isolating libming 0.4.8 decompilation in sandboxed, least-privilege containers with no network access and memory limits; blocking or allowlisting SWF inputs; disabling automatic decompilation of untrusted SWF files; monitoring decompile processes for crashes; and migrating to a maintained SWF parser/decompiler where feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Affected Products (CPE)CVE.org
Buffer Overflow vulnerability in libming version 0.4.8, allows attackers to execute arbitrary code and obtain sensitive
Ming (aka libming) 0.4.8 has a heap-based buffer over-read (2 bytes) in the function decompileIF() in decompile.c. Rated
Ming (aka libming) 0.4.8 has a heap-based buffer over-read (8 bytes) in the function decompileIF() in decompile.c. Rated
Ming (aka libming) 0.4.8 has an out of bounds read vulnerability in the function OpCode() in the decompile.c file in lib
libming listswf 0.4.7 was discovered to contain a buffer overflow in the parseSWF_DEFINEFONTINFO() function at parser.c.
libming v0.4.8 was discovered to contain a stack buffer overflow via the function makeswf_preprocess at /util/makeswf_ut
Ming (aka libming) 0.4.8 has a heap-based buffer over-read in the function decompile_SWITCH() in decompile.c. Rated high
Ming (aka libming) 0.4.8 has an out of bounds write vulnerability in the function strcpyext() in the decompile.c file in
Ming (aka libming) 0.4.8 has a NULL pointer dereference in the function getString() in the decompile.c file in libutil.a
The readBytes function in util/read.c in libming through 0.4.8 allows remote attackers to have unspecified impact via a
The parseSWF_ACTIONRECORD function in util/parser.c in libming through 0.4.8 allows remote attackers to have unspecified
libming 0.4.8 has a NULL pointer dereference in the getName function of the decompile.c file, a different vulnerability
Exploit-DB