A heap buffer overflow in the r_readc() function of the libming library allows a crafted SWF file containing a malformed or truncated RECT header to trigger a denial of service. The flaw arises when input data is read into a buffer larger than the allocated space, leading to corruption of the heap and program termination. The weakness is a classic heap buffer overflow, commonly tracked by CWE-122.

All software that relies on libming versions up to and including 0.4.8 is affected. This includes any application that parses or manipulates SWF files through the libming library, regardless of vendor. The exact vendor or product names are not listed in the advisory, but any deployment using the specified library version is at risk.

The vulnerability has no associated EPSS score and is not listed in CISA’s KEV catalog, so its exploitation likelihood is currently unknown. The attack vector is local or remote depending on whether the application processes user‑supplied SWF files. Because the flaw triggers a crash rather than code execution, lateral impact is limited to service disruption; however, repeated exploitation could affect availability in high‑traffic environments.