CVE-2023-35957

What it actually does

Heap-based buffer overflow in the uncompress function during fstReaderIterBlocks2 VCDATA parsing of .fst files leads to arbitrary code execution.

Why it matters to the business

Attackers can gain full control of affected systems when users open malicious files, risking data theft, ransomware deployment, or persistent access; exploit code is publicly available and the package appears in many Debian environments.

How an attack unfolds

An attacker creates a specially crafted .fst file that triggers the decompression overflow in uncompress, then delivers the file via email, download, or shared storage; the victim opens it in the vulnerable application, causing the overflow to execute attacker-supplied code.

How to fix it

Upgrade chromium on Debian 12 to version 126.0.6478.56-1~deb12u1 or later; avoid opening untrusted .fst files until patched.

How to confirm the fix worked

Verify package version matches or exceeds 126.0.6478.56-1~deb12u1; test that crafted .fst files no longer trigger crashes or code execution.

Typical attack path

1. Craft malicious .fst file exploiting uncompress buffer overflow
2. Distribute file to target users
3. Victim opens file in vulnerable application
4. Overflow occurs during VCDATA parsing
5. Attacker achieves arbitrary code execution

How to detect it

Review file-open logs and process creation events around .fst files; look for unexpected crashes or code execution in the affected application.

What your security team should do

• Apply the listed Debian chromium update immediately
• Block or sandbox opening of .fst files from untrusted sources
• Monitor for new exploit releases given public exploit maturity