CVE-2025-29484
Published: 27 March 2025
Summary
CVE-2025-29484 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Libming Libming. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 28.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-29484 is an out-of-memory error vulnerability in the parseABC_NS_SET_INFO function of libming version 0.4.8. This flaw allows attackers to trigger allocator exhaustion, resulting in a Denial of Service (DoS) condition. The vulnerability is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-400 (Uncontrolled Resource Consumption). It was published on 2025-03-27.
Remote attackers require no privileges or user interaction to exploit this issue over the network with low complexity. Successful exploitation leads to high-impact availability disruption through resource exhaustion, potentially crashing applications that process untrusted Ming SWF files using the affected libming library.
Mitigation details and further discussion are available in the libming GitHub repository issue at https://github.com/libming/libming/issues/330.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8455
Vulnerability details
An out-of-memory error in the parseABC_NS_SET_INFO function of libming v0.4.8 allows attackers to cause a Denial of Service (DoS) due to allocator exhaustion.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The out-of-memory vulnerability directly enables remote exploitation of libming to cause application crash and denial of service via resource exhaustion, matching T1499.004 Application or System Exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Remediating the specific out-of-memory flaw in libming v0.4.8 via patches from the GitHub issue directly prevents attackers from triggering allocator exhaustion during SWF file parsing.
Denial-of-service protection mechanisms limit resource consumption, blocking remote attackers from causing availability disruption through allocator exhaustion in libming.
Input validation of untrusted Ming SWF files before processing with libming prevents malformed inputs from reaching the vulnerable parseABC_NS_SET_INFO function and triggering OOM.