CVE-2023-35703

What it actually does

Stack-based buffer overflow in fstReaderVarint64 during LEB128 varint parsing of .fst files leading to arbitrary code execution.

Why it matters to the business

Users opening malicious files can result in full system compromise; exploit code is publicly available increasing risk though not observed in ransomware or KEV campaigns, and the issue affects widely distributed packages with many dependents.

How an attack unfolds

Attacker creates a crafted .fst file that overflows the stack buffer in fstReaderVarint64; victim opens the file in the vulnerable application triggering the overflow and allowing arbitrary code execution.

How to fix it

Upgrade affected packages to the listed fixed versions including chromium (Debian:12) fixed in 126.0.6478.56-1~deb12u1.

How to confirm the fix worked

Verify package versions match or exceed the fixed releases and test opening of known-good .fst files without crashes or unexpected behavior.

Typical attack path

1. Craft malicious .fst file exploiting LEB128 varint parsing
2. Deliver file to target user via email or download
3. User opens file in affected software
4. Buffer overflow executes attacker-supplied code

How to detect it

Review file access logs and process execution records for unexpected .fst file handling; look for crashes or anomalous child processes spawned after opening .fst files.

What your security team should do

• Apply the specified package updates immediately given public exploit availability
• Block untrusted .fst files at email and web gateways
• Monitor for new exploit samples targeting this memory corruption issue