CVE-2023-35955

What it actually does

Heap-based buffer overflow in the LZ4_decompress_safe_partial function during VCDATA parsing of .fst files allowing arbitrary code execution.

Why it matters to the business

Attackers can achieve code execution if users open malicious files, risking system compromise; affects Debian chromium packages with many downstream dependents and requires urgent patching per published fixed versions.

How an attack unfolds

An attacker creates a malicious .fst file that triggers the buffer overflow in the decompression function when parsed; the victim opens the file in the vulnerable application leading to arbitrary code execution. No named threat actors or ransomware usage reported.

How to fix it

Upgrade chromium on Debian 12 to version 126.0.6478.56-1~deb12u1.

How to confirm the fix worked

Confirm the installed package version matches or exceeds the fixed version and test opening of .fst files for expected behavior without crashes.

Typical attack path

1. Craft a malicious .fst file targeting the VCDATA parsing and LZ4 decompression
2. Distribute the file to the victim via email or download
3. Victim opens the file in the affected application
4. Heap overflow occurs resulting in arbitrary code execution

How to detect it

Monitor application crash logs and process behavior when .fst files are opened; look for indicators of heap corruption or unexpected code paths in file parsing.

What your security team should do

• Immediately apply the listed fixed package versions across all affected Debian chromium installations
• Block untrusted .fst files at email and download gateways
• Review and harden file handling policies for waveform analysis tools