Security readout for executives and security teams
Plain-English summary
A flaw in SWFTools PDF processing can crash the tool when a user or automated workflow processes a malicious file. The reported impact is availability only, not data theft or privilege gain. Business urgency depends on whether SWFTools/pdf2swf handles untrusted PDFs in production pipelines.
Executive priority
Moderate priority. Act faster if SWFTools processes customer-supplied PDFs or supports production document workflows. Lower priority where SWFTools is absent or only used manually on trusted files.
Technical view
CVE-2022-35099 is a CWE-787 stack overflow in ImageStream::getPixel(unsigned char*) in /xpdf/Stream.cc, reported against SWFTools commit 772e55a2. CVSS 3.1 is 5.5 with local attack vector, user interaction required, and high availability impact.
Likely exposure
Exposure is likely limited to systems running SWFTools, especially pdf2swf, where users or services process untrusted PDF content. The CVE record does not provide CPEs or affected version ranges, so asset confirmation requires local inventory and build review.
Exploitation context
The source bundle includes a GitHub issue and a public PoC reference, but no KEV listing and no cited evidence of active exploitation. Treat it as publicly documented crash risk, not confirmed in-the-wild exploitation.
Researcher notes
The record lacks affected product metadata, CPEs, and explicit fixed-version guidance. Analysis should stay tied to the named commit, function, file path, CVSS vector, and public references. Do not infer broader Xpdf or unrelated SWFTools version impact without source confirmation.
Mitigation direction
- Identify SWFTools and pdf2swf usage across servers, workstations, and build pipelines.
- Avoid processing untrusted PDFs until vendor or maintainer guidance is confirmed.
- Run SWFTools conversions with least privilege and process isolation where feasible.
- Monitor the upstream issue and CVE record for fixed versions or commits.
- Prioritize replacement or compensating controls for internet-facing ingestion workflows.
Validation and detection
- Confirm whether any deployed SWFTools build maps to commit 772e55a2 or nearby vulnerable code.
- Review file-ingestion paths for automated PDF-to-SWF conversion using SWFTools.
- Check service logs for unexplained pdf2swf or SWFTools crashes.
- Verify controls around untrusted PDF intake, sandboxing, and job restarts.
- Track whether the referenced upstream issue identifies an accepted fix.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-35099 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/matthiaskramm/swftools/issues/182CVE reference · x_refsource_MISC
- https://github.com/Cvjark/Poc/blob/main/swftools/pdf2swf/CVE-2022-35099.mdCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.