CVE-2025-29484
Published: 27 March 2025
Description
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Security Summary
CVE-2025-29484 is an out-of-memory error vulnerability in the parseABC_NS_SET_INFO function of libming version 0.4.8. This flaw allows attackers to trigger allocator exhaustion, resulting in a Denial of Service (DoS) condition. The vulnerability is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-400 (Uncontrolled Resource Consumption). It was published on 2025-03-27.
Remote attackers require no privileges or user interaction to exploit this issue over the network with low complexity. Successful exploitation leads to high-impact availability disruption through resource exhaustion, potentially crashing applications that process untrusted Ming SWF files using the affected libming library.
Mitigation details and further discussion are available in the libming GitHub repository issue at https://github.com/libming/libming/issues/330.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The out-of-memory vulnerability directly enables remote exploitation of libming to cause application crash and denial of service via resource exhaustion, matching T1499.004 Application or System Exploitation.