CVE-2023-35956

What it actually does

Heap-based buffer overflow in fastlz_decompress during VCDATA parsing of .fst files allows arbitrary code execution upon opening a malicious file.

Why it matters to the business

Successful exploitation can lead to full system compromise and data theft or ransomware deployment on affected workstations; the issue affects widely deployed Debian chromium packages with a high volume of downstream dependents and remains exploitable over a year after disclosure.

How an attack unfolds

An attacker crafts a malicious .fst file that triggers the fastlz_decompress overflow, then delivers it via email, web download, or removable media; when a victim opens the file the overflow is triggered leading to arbitrary code execution.

How to fix it

Upgrade chromium on Debian 12 to version 126.0.6478.56-1~deb12u1 or later; remove or restrict execution of older chromium packages until patched.

How to confirm the fix worked

Verify chromium package version is at or above 126.0.6478.56-1~deb12u1 using apt policy or dpkg; test that the application rejects or safely handles known malicious .fst test files without crashing or executing injected code.

Typical attack path

1. Craft .fst file containing oversized or malformed compressed VCDATA blocks targeting fastlz_decompress
2. Host or transmit the malicious file to the target user
3. User opens the file in the vulnerable application
4. Overflow occurs resulting in arbitrary code execution

How to detect it

Search application and system logs for crashes or unexpected process spawns immediately after opening .fst files; inspect file-handling telemetry for recently received .fst files from untrusted sources.

What your security team should do

• Immediately schedule the chromium upgrade to 126.0.6478.56-1~deb12u1 across all Debian 12 systems
• Block or sandbox opening of untrusted .fst files until patches are applied
• Monitor for new exploit samples and update detection rules accordingly