A flaw in libming versions up to 0.4.8 allows a remote attacker to trigger a crash by sending a crafted SWF file that exploits the readtag_file() routine in src/blocks/fromswf.c. The crash results in application or service termination, denying legitimate users access to the affected functionality. The weakness is an improper handling of input that leads to out‑of‑bounds access, categorized as CWE-400. No evidence of code execution or privilege escalation is present.

The vulnerability targets any installation that links against libming 0.4.8 or earlier. Software that relies on libming for parsing or rendering Flash (SWF) files—such as graphics editors, converters, or embedded players—could be impacted. Because the vendor or product names are not specified, any system using the vulnerable library version is potentially at risk.

The likely attack vector is remote, as an attacker can supply a maliciously crafted SWF file to a vulnerable application. No authentication or privileged access is required; simply triggering the libming parser is sufficient. The CVSS score of 7.5 reflects high severity, while the EPSS score of <1% indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, which reduces documented exploitation pressure. Nonetheless, the denial of service impact can disrupt operations for services that process Flash content.