LiveActive security incident?Get immediate response
CVE Record

CVE-2017-8400: In SWFTools 0.9.2, an out-of-bounds write of heap data can occur in the function png_load() in lib/png.c:755.

In SWFTools 0.9.2, an out-of-bounds write of heap data can occur in the function png_load() in lib/png.c:755. This issue can be triggered by a malformed PNG file that is mishandled by png2swf. Attackers could exploit this issue for DoS; it might cause arbitrary code execution.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2017-8400 is a memory corruption issue in SWFTools 0.9.2 when png2swf processes a malformed PNG. A successful trigger could crash the conversion process, and the source notes possible arbitrary code execution. Business risk depends on whether SWFTools handles untrusted image uploads or automated conversion jobs.

Executive priority

Prioritize review if image conversion is internet-facing, customer-facing, or part of automated document/media ingestion. If SWFTools is absent, priority is low. If present on trusted-only internal workflows, manage through normal vulnerability remediation and isolation controls.

Technical view

The CVE describes an out-of-bounds heap write in png_load() in lib/png.c:755 in SWFTools 0.9.2. The trigger is a malformed PNG mishandled by png2swf. The published record lists denial of service as an expected impact and arbitrary code execution as possible, but provides no CVSS, CWE, or patch detail.

Likely exposure

Exposure is most likely where SWFTools 0.9.2 or png2swf processes PNG files from users, partners, queues, archives, or batch media pipelines. Systems without SWFTools, without png2swf, or only processing trusted local PNGs have lower likely exposure.

Exploitation context

The source bundle does not show active exploitation, and KEV status is false. Public evidence provided is limited to the CVE description and a GitHub issue reference. Treat exploitability as plausible memory corruption, but do not assume weaponized exploitation without more evidence.

Researcher notes

Evidence is sparse: no CVSS, CWE, affected CPE, patch version, or exploitation status is included. The strongest grounded facts are SWFTools 0.9.2, png2swf, malformed PNG trigger, heap out-of-bounds write, DoS impact, and possible code execution.

Mitigation direction

  • Check SWFTools project guidance for a fixed release or maintained replacement.
  • Disable png2swf processing of untrusted PNGs until guidance is confirmed.
  • Run conversion jobs in sandboxed, least-privileged worker environments.
  • Apply memory, CPU, and restart controls to reduce denial-of-service impact.
  • Quarantine malformed PNG inputs that crash or destabilize conversion jobs.

Validation and detection

  • Inventory servers, containers, and build artifacts for SWFTools 0.9.2 and png2swf.
  • Map all workflows where PNG files are passed into png2swf.
  • Identify whether any mapped inputs are user-controlled or externally sourced.
  • Review crash logs for png2swf, png_load, or image-conversion worker failures.
  • Confirm conversion workers run with isolation, low privileges, and resource limits.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2017-8400 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.