CVE-2023-35950

What it actually does

Stack-based buffer overflow in readOFF.cpp header parsing of libigl v2.4.0 when processing a specially crafted .off file, enabling arbitrary code execution via stack overwrite.

Why it matters to the business

Attackers can achieve remote code execution on systems that parse untrusted .off files using the affected library, potentially leading to full host compromise. Affects jbig2enc on Debian 14 with stable low EPSS and no known ransomware use; fix available in 0.30-1.

How an attack unfolds

An attacker creates a malicious .off file with an oversized header that triggers the buffer overflow during parsing; the victim application loads the file, the overflow occurs in readOFF.cpp, and control flow is hijacked for code execution. No public exploits or threat actors are associated.

How to fix it

Upgrade jbig2enc on Debian 14 to version 0.30-1 or later. Avoid processing untrusted .off files until patched. Monitor for upstream libigl updates addressing readOFF.cpp.

How to confirm the fix worked

Verify package version is at least 0.30-1 on Debian 14 systems. Test by attempting to parse known-good and malformed .off files in a sandboxed environment after upgrade.

Typical attack path

1. Craft malicious .off file with oversized header data
2. Deliver file to target via email, download, or shared storage
3. Victim opens or processes the file with vulnerable libigl code
4. Buffer overflow occurs in header parsing routine
5. Attacker gains arbitrary code execution on the host

How to detect it

Search application and system logs for unexpected crashes or errors during .off file parsing. Monitor process execution following file access events involving .off extensions. No confirmed exploitation artifacts reported.

What your security team should do

• Apply the 0.30-1 update to jbig2enc immediately on all Debian 14 instances
• Block or sandbox processing of .off files from untrusted sources
• Add file-type filtering rules for .off in document workflows
• Review EPSS trend monthly for any increase in exploitation likelihood