CVE-2022-46293

What it actually does

Out-of-bounds write during translationVectors parsing in the MOPAC file format handler, enabling arbitrary code execution via a malformed file.

Why it matters to the business

Processing of untrusted files on Debian systems can lead to full system compromise with arbitrary code execution; low urgency given stable low EPSS, no KEV listing, and no observed ransomware or APT use despite high CVSS.

How an attack unfolds

An attacker creates a specially crafted MOPAC file containing malformed data in the Final Point and Derivatives section to trigger the out-of-bounds write during parsing; the file is delivered to a victim who opens it with the vulnerable software, resulting in arbitrary code execution.

How to fix it

Upgrade affected chromium packages on Debian 11 to version 119.0.6045.105-1~deb11u1 or later; avoid opening untrusted MOPAC or other chemical file formats until patched.

How to confirm the fix worked

Verify package version is 119.0.6045.105-1~deb11u1 or newer via apt; test parsing of known-good MOPAC files succeeds without crashes or unexpected behavior.

Typical attack path

1. Create malformed MOPAC file targeting translationVectors parsing
2. Deliver malicious file to target via email, download, or shared storage
3. Victim opens file using affected Open Babel functionality
4. Parser triggers out-of-bounds write leading to code execution

How to detect it

Review file access logs and process execution history for unexpected invocations of chemical file parsers on user-supplied MOPAC files; look for crashes or segmentation faults during parsing.

What your security team should do

• Apply the listed chromium package update immediately on all Debian 11 systems
• Restrict opening of chemical structure files from untrusted sources
• Monitor EPSS and KEV updates for any change in exploitation likelihood