EUVD-2026-95303
GHSA-w3m4-q296-772h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed SWF file
-
ExploitDeliver file to libming-based parser
-
ExecutionTrigger resource exhaustion in readtag_file()
-
ImpactParser process crashes/hangs (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a libming-based application or tool parse an attacker-supplied, malformed SWF file through the readtag_file() code path in src/blocks/fromswf.c (the fromswf conversion/import routine). The limiting factor is file delivery and processing: the attacker must get a crafted SWF into a parsing workflow, and remote reachability depends on whether a network service feeds untrusted SWF files to libming - a standalone CLI invocation requires a user/process to run the tool against the malicious file. Impact is confined to denial of service of the parsing process (no code execution, no data disclosure); affected versions are libming through 0.4.8. |
| Impact | Signals are consistent and point to LOW real-world priority despite the 7.5 'High' CVSS base score. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is driven entirely by the availability metric (A:H) with no confidentiality or integrity impact, which is characteristic of a CWE-400 resource-consumption/crash issue. EPSS is very low at 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit was identified - so this is neither actively exploited nor widely weaponized. A key conflict must be flagged: the CVSS claims AV:N (network) and UI:N, but libming is an SWF-generation/parsing library and readtag_file() in src/blocks/fromswf.c processes a supplied SWF file - in practice this is a crafted-file parsing bug that is network-reachable only if some service feeds attacker-supplied SWF files into the library; a standalone CLI/library use case is effectively local and requires the victim to process the malicious file. Verify the real deployment context with the vendor/consumer. No SSVC decision data was provided. Overall: a genuine but low-severity DoS in a niche library - routine patch cadence, not an emergency. |
| Exploit ScenarioDerived | An attacker crafts a malformed SWF file that triggers uncontrolled resource consumption in libming's readtag_file() parser. When an application or user processes this file with a libming-based tool, the parser exhausts resources or crashes, denying service for that parsing process. No public exploit code was identified, though the linked GitHub issue (#449) likely references a reproducer file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Denial of service in libming through 0.4.8 occurs when a libming-based tool parses an attacker-supplied malformed SWF file through the readtag_file() code path in src/blocks/fromswf.c, causing the parsing process to crash or exhaust resources. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) shows this requires user interaction and carries only availability impact, so remote exploitation applies only where a network service actually feeds untrusted SWF input into libming, while a standalone CLI run needs a user or process to open the crafted file. No public exploit code was identified at time of analysis and EPSS is 0.18% (7th percentile), so despite NVD's 7.5 base score the real-world priority is low.
RemediationAI
No vendor-released patch is identified in the available intelligence for CVE-2026-95116 at time of analysis, and the upstream GitHub issue https://github.com/libming/libming/issues/449 is the tracking point for any fix while https://nvd.nist.gov/vuln/detail/CVE-2026-95116 should be monitored for updates. Until a fix ships, the strongest control is to stop feeding untrusted or attacker-supplied SWF files into libming-based parsing and conversion workflows, particularly the fromswf path, accepting the trade-off that this removes the tool's ability to process untrusted input. Where untrusted parsing cannot be avoided, run the conversion in a sandboxed, least-privileged process with hard memory and CPU ceilings (cgroups, ulimit -v, or an external timeout) so a malformed SWF produces a contained process failure instead of host-wide resource exhaustion, understanding that legitimate large files may be truncated or killed; additionally, restrict any network service that accepts SWF uploads to trusted clients or validate and size-limit files before they reach libming, and prefer an actively maintained SWF parser where a drop-in replacement is feasible.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libming is a C library for parsing, creating and manipulating Macromedia Flash (SWF) files, and its fromswf conversion routine in src/blocks/fromswf.c walks SWF tag records through readtag_file() to translate SWF content into other formats. The root-cause class is CWE-400 (Uncontrolled Resource Consumption): a malformed or internally inconsistent tag stream drives excessive iteration, recursion or allocation in readtag_file() before the parser properly validates the input, terminating or hanging the host process. The CPE provided with this record is unpopulated (n/a:n/a), so affected-product identification rests on the vendor and version statement that all libming releases through 0.4.8 are affected. Because libming is normally consumed indirectly as a dependency of SWF inspection and conversion utilities, exposure depends on how the consuming application handles untrusted files; the assessed vector (AV:L, UI:R, PR:N, A:L) reflects a file-delivery-plus-parsing attack path, which is why the unqualified network-oriented 7.5 base score overstates the practical risk.
Know when Libming gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Crafted-file parsing bug: a victim must process an attacker-supplied SWF (AV:L, UI:R); crash is limited to the parsing process, so A:L and C/I:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue in libming through 0.4.8 allows a remote attacker to cause a denial of service via the readtag_file() in src/blocks/fromswf.c.
Executive ViewAI
libming versions through 0.4.8 contain a denial-of-service vulnerability that can crash or exhaust resources when processing a malformed SWF file. Organizations using libming-based tools to parse untrusted SWF content, especially in network services, face availability disruptions, though exploitation requires user interaction and no public exploit has been identified. Leadership should prioritize inventory and containment over emergency patching while monitoring for vendor updates.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict processing of untrusted SWF files to isolated, low-privilege processes; implement input validation and file-type allowlisting; disable SWF parsing in network services unless essential; monitor for crashes or resource exhaustion; and consider migrating to an actively maintained SWF parsing library.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Buffer Overflow vulnerability in libming version 0.4.8, allows attackers to execute arbitrary code and obtain sensitive
Ming (aka libming) 0.4.8 has a heap-based buffer over-read (2 bytes) in the function decompileIF() in decompile.c. Rated
Ming (aka libming) 0.4.8 has a heap-based buffer over-read (8 bytes) in the function decompileIF() in decompile.c. Rated
Ming (aka libming) 0.4.8 has an out of bounds read vulnerability in the function OpCode() in the decompile.c file in lib
libming listswf 0.4.7 was discovered to contain a buffer overflow in the parseSWF_DEFINEFONTINFO() function at parser.c.
libming v0.4.8 was discovered to contain a stack buffer overflow via the function makeswf_preprocess at /util/makeswf_ut
Ming (aka libming) 0.4.8 has a heap-based buffer over-read in the function decompile_SWITCH() in decompile.c. Rated high
Ming (aka libming) 0.4.8 has an out of bounds write vulnerability in the function strcpyext() in the decompile.c file in
Ming (aka libming) 0.4.8 has a NULL pointer dereference in the function getString() in the decompile.c file in libutil.a
The readBytes function in util/read.c in libming through 0.4.8 allows remote attackers to have unspecified impact via a
The parseSWF_ACTIONRECORD function in util/parser.c in libming through 0.4.8 allows remote attackers to have unspecified
libming 0.4.8 has a NULL pointer dereference in the getName function of the decompile.c file, a different vulnerability
Exploit-DB