Security readout for executives and security teams
Plain-English summary
This issue can make SWFTools gif2swf crash when it processes a crafted input file. The business impact is availability, not data theft, based on the supplied CVSS vector. Risk is highest where file conversion is automated or exposed to user-supplied media.
Executive priority
Treat as a moderate availability risk. Prioritize remediation if SWFTools is used in customer-facing or automated file-processing paths; otherwise handle through normal vulnerability management after confirming exposure.
Technical view
CVE-2022-35087 describes a segmentation violation in SWFTools commit 772e55a2, in MovieAddFrame within src/gif2swf.c. The record maps to memory-safety CWEs including out-of-bounds read, null pointer dereference, and out-of-bounds write. CVSS 3.1 is 5.5 with local attack vector and required user interaction.
Likely exposure
Exposure is likely limited to systems running SWFTools gif2swf, especially batch conversion jobs or services that process untrusted GIF inputs. The source bundle does not identify affected versions beyond a specific commit and lists vendor/product as n/a.
Exploitation context
The source bundle includes a public GitHub issue and PoC reference, but KEV is false and no cited source states active exploitation. Exploitation requires a local processing context and user interaction according to the CVSS vector.
Researcher notes
Evidence is sparse: the CVE identifies a crash location and commit, but not a complete affected-version range or fixed release. Do not assume broader product impact without repository or vendor confirmation.
Mitigation direction
- Inventory any SWFTools gif2swf use in production, CI, and media workflows.
- Check upstream SWFTools guidance or repository activity for a confirmed fix.
- Avoid processing untrusted GIF files with gif2swf until exposure is understood.
- Run file conversion inside a sandboxed, resource-limited environment.
- Restrict access to automated conversion endpoints and queues.
Validation and detection
- Confirm whether deployed systems include SWFTools gif2swf.
- Identify workflows accepting externally supplied GIF files for conversion.
- Compare deployed source or package state against commit 772e55a2 evidence.
- Review crash logs for gif2swf segmentation faults during media processing.
- Verify compensating controls such as sandboxing and resource limits.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-35087 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/matthiaskramm/swftools/issues/181CVE reference · x_refsource_MISC
- https://github.com/Cvjark/Poc/blob/main/swftools/gif2swf/CVE-2022-35087.mdCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.