CVE-2025-29490: Libming DoS Vulnerability

CVE-2025-29490 Overview

CVE-2025-29490 is a denial-of-service vulnerability in libming v0.4.8, an open-source library for creating and manipulating Adobe Flash SWF files. The flaw resides in the decompileCALLMETHOD function, where processing a malformed SWF file triggers a segmentation fault. Attackers can deliver a crafted SWF file to any application or workflow that parses input through libming, causing the process to crash. The vulnerability is classified under [CWE-400] (Uncontrolled Resource Consumption) and requires user interaction to trigger. No authentication is required, and the attack vector is network-based when malicious files are distributed via web downloads, email attachments, or file-sharing systems.

Critical Impact
Attackers can crash any application, decompiler, or automated pipeline that processes untrusted SWF files through libming v0.4.8, disrupting availability.

Affected Products

libming v0.4.8
Applications and utilities that link against libming v0.4.8 for SWF parsing
Automated file-processing pipelines (fuzzers, decompilers, converters) using libming

Discovery Timeline

2025-03-27 - CVE-2025-29490 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29490

Vulnerability Analysis

The vulnerability exists in the decompileCALLMETHOD function within libming's ActionScript decompiler. When the function processes a crafted SWF file, it dereferences memory in an unsafe manner and triggers a segmentation fault. The result is an abrupt process termination, denying service to any caller relying on the library.

libming is commonly embedded in analysis tooling and format converters. A single malformed input can therefore disrupt batch processing, reverse engineering workflows, and web services that convert or inspect Flash content.

Root Cause

The root cause is insufficient validation of decompiled bytecode operands inside decompileCALLMETHOD. The function operates on attacker-controlled data structures from the SWF stream without verifying pointer validity or operand counts before dereferencing them. This uncontrolled resource condition falls under [CWE-400].

Attack Vector

Exploitation requires an attacker to deliver a crafted SWF file and induce the target to open it with a vulnerable libming-based tool. Delivery channels include phishing attachments, malicious web downloads, and shared analysis corpora. Successful exploitation crashes the parsing process but does not, based on the reported behavior, yield code execution.

A proof-of-concept file and reproduction notes are documented at the GitHub PoC Repository and tracked upstream in GitHub Issue #330.

Detection Methods for CVE-2025-29490

Indicators of Compromise

Repeated crashes or segmentation faults from processes that invoke libming utilities such as swftophp, swftoperl, or custom parsers.
Core dumps referencing the decompileCALLMETHOD symbol in the call stack.
Inbound SWF files from untrusted sources that fail to decompile cleanly.

Detection Strategies

Monitor host telemetry for abnormal termination of libming-linked binaries with SIGSEGV exit codes.
Inspect SWF file submissions in automated analysis pipelines and log parsing failures with associated file hashes.
Correlate crash events with the delivery of SWF files across email, web proxy, and file share logs.

Monitoring Recommendations

Enable core dump collection for libming-based services to capture the faulting function during triage.
Rate-limit and sandbox SWF parsing services so that repeated crashes do not degrade shared infrastructure.
Track upstream activity on GitHub Issue #330 for patch availability.

How to Mitigate CVE-2025-29490

Immediate Actions Required

Inventory all applications, scripts, and containers that ship or link libming v0.4.8.
Restrict processing of untrusted SWF files to isolated, sandboxed environments with resource limits.
Block or quarantine inbound SWF attachments at email and web gateways where business use cases do not require them.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Monitor the upstream project via GitHub Issue #330 for a fix. Until an official release is available, rebuild libming from a maintained fork that addresses decompileCALLMETHOD or replace the dependency with an actively maintained SWF parser.

Workarounds

Run libming-based tools under a supervisor that restarts crashed processes and isolates them with seccomp, AppArmor, or containers.
Validate SWF inputs with an allow-list of trusted sources before passing them to libming.
Disable SWF decompilation features in downstream applications when the functionality is not required.

bash

# Configuration example: sandbox libming-based swftophp with resource limits
systemd-run --scope --uid=nobody --gid=nogroup \
  -p MemoryMax=256M -p CPUQuota=25% -p PrivateTmp=yes \
  -p NoNewPrivileges=yes -p ProtectSystem=strict \
  /usr/bin/swftophp /var/quarantine/untrusted.swf