CVE-2023-35704

What it actually does

Stack-based buffer overflow in fstReaderVarint32WithSkip during LEB128 varint parsing allows arbitrary code execution when processing a malicious .fst file.

Why it matters to the business

Attackers can achieve full system compromise on affected Debian chromium installations if users open malicious files, increasing risk of data theft or ransomware; the issue affects widely deployed packages with available updates since early 2024.

How an attack unfolds

An attacker creates a specially crafted .fst file exploiting the varint parsing flaw, then delivers it to a victim who opens it in the vulnerable application, triggering the overflow and executing attacker-controlled code.

How to fix it

Upgrade chromium on Debian 12 to version 126.0.6478.56-1~deb12u1 or later using apt; verify the update and restart affected applications.

How to confirm the fix worked

Confirm package version is at or above 126.0.6478.56-1~deb12u1 via dpkg -l | grep chromium and test opening known-good .fst files without crashes.

Typical attack path

1. Craft malicious .fst file targeting fstReaderVarint32WithSkip
2. Deliver file via email, download, or shared storage
3. Victim opens file in vulnerable chromium on Debian 12
4. Buffer overflow occurs leading to arbitrary code execution

How to detect it

Review system logs for chromium crashes or unexpected process spawns after opening .fst files; check file integrity of received .fst files and audit recent file open events in user directories.

What your security team should do

• Immediately apply the listed chromium update across all Debian 12 systems
• Block opening of untrusted .fst files via email gateways and file filters
• Monitor for exploit attempts using available public proof-of-concept code