CVE-2025-29494: 
Homebrew vulnerability analysis and mitigation

libming v0.4.8 was discovered to contain a segmentation fault vulnerability in the decompileGETMEMBER function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SWF file. The vulnerability was disclosed on March 27, 2025, and affects libming version 0.4.8 (NVD).

The vulnerability is caused by a READ memory access to an invalid address pointing to the zero page in the decompileGETMEMBER function. The issue occurs during the decompilation process of SWF files, specifically when handling GETMEMBER actions. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) (NVD, Github Issue).

When exploited, this vulnerability can lead to a Denial of Service (DoS) condition through segmentation faults. The impact is primarily on the availability of systems processing SWF files, as the vulnerability can be triggered by processing specially crafted SWF files, potentially causing the application to crash (NVD).

The vulnerability can be exploited by processing a specially crafted SWF file. A proof of concept (PoC) exploit has been publicly disclosed, demonstrating the segmentation fault in the decompileGETMEMBER function (PoC Readme, Github Issue).