CVE-2023-36239
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
Version 0.4.7 of the libming library was found to contain a buffer overflow in the parseSWF_DEFINEFONTINFO() function in parser.c.
Risk Assessment
The buffer overflow may lead to the execution of malicious code, posing a serious security risk to applications using this library.
Recommendation
It is recommended to update the libming library to the latest version to mitigate this vulnerability.
Other vulnerabilities in libming 0.4.7
See all- CVE-2017-7578High
Multiple heap-based buffer overflows in parser.c in libming 0.4.7 allow remote attackers to cause a denial of service (listswf application crash) or possibly have unspecified other impact via a crafted SWF file.
- CVE-2016-9831High
A heap-based buffer overflow in the parseSWF_RGBA function in parser.c in the listswf tool in libming 0.4.7 allows remote attackers to exploit it via a crafted SWF file.
- CVE-2016-9829High
A heap-based buffer overflow in the parseSWF_DEFINEFONT function in parser.c in the listswf tool in libming 0.4.7 allows remote attackers to exploit this vulnerability via a crafted SWF file.
- CVE-2026-95116High
An issue in libming through 0.4.8 allows a remote attacker to cause a denial of service via the readtag_file() in src/blocks/fromswf.c.
- CVE-2026-95125Low risk· EPSS 6%
libming through 0.4.8 contains a heap buffer overflow in r_readc() in src/blocks/fromswf.c. A crafted SWF file with a malformed or truncated RECT header can cause a denial of service.
- CVE-2025-66877High
A buffer overflow vulnerability in the dcputchar function in decompile.c in libming 0.4.8. It may lead to crashes or code execution.
- CVE-2025-66869High
In libming 0.4.8, there is a buffer overflow vulnerability in the strcat function in asan_interceptors.cpp.
Original NVD description (English source)
libming listswf 0.4.7 was discovered to contain a buffer overflow in the parseSWF_DEFINEFONTINFO() function at parser.c.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS