CVE-2022-48545

What it actually does

Infinite recursion in Catalog::findDestInTree triggers stack exhaustion and denial of service when parsing crafted PDF documents.

Why it matters to the business

Users on Debian 11 running affected Chromium packages may experience unexpected application crashes or freezes when opening certain PDF files, leading to workflow disruption and potential data loss for unsaved work.

How an attack unfolds

An attacker crafts a PDF containing a cyclic destination structure that forces repeated calls to findDestInTree; the file is delivered to a target who opens it in the vulnerable Chromium package, causing immediate resource exhaustion and application termination.

How to fix it

Upgrade the chromium package on Debian 11 to version 120.0.6099.109-1~deb11u1 or later using apt. If immediate patching is not possible, restrict PDF handling to trusted sources and consider sandboxed viewers.

How to confirm the fix worked

Confirm the installed chromium version is at least 120.0.6099.109-1~deb11u1 via apt policy or dpkg -l. Test with known trigger PDFs in an isolated environment to verify the recursion no longer occurs.

Typical attack path

1. Craft a PDF with cyclic /Dest entries designed to trigger infinite recursion in findDestInTree
2. Deliver the malicious PDF via email, web download, or shared storage
3. Victim opens the document using the affected Chromium package on Debian 11
4. Application enters unbounded recursion, exhausts stack memory, and crashes

How to detect it

Review system and application logs for unexpected Chromium crashes or segmentation faults immediately after PDF file access; correlate with file creation or download timestamps of untrusted PDFs.

What your security team should do

• Prioritize patching all Debian 11 systems running Chromium to the listed fixed version within the next maintenance window
• Add package version checks to vulnerability scanning and asset inventory processes
• Educate users on avoiding unsolicited PDFs until patches are deployed
• Monitor upstream Debian security advisories for any related backports