CVE-2023-35958

What it actually does

Heap-based buffer overflow in fstFread during VCDATA parsing allows arbitrary code execution when a malicious .fst file is opened.

Why it matters to the business

Successful exploitation can result in full system compromise on user workstations or developer systems that process untrusted waveform files, with moderate urgency given available public exploits and over 1000 days since publication.

How an attack unfolds

An attacker creates a specially crafted .fst file that triggers the overflow in the fstFread copy routine inside fstReaderIterBlocks2; the victim opens the file in the affected application, causing the overflow to hijack control flow and execute attacker-supplied code.

How to fix it

Upgrade affected chromium packages on Debian 12 to version 126.0.6478.56-1~deb12u1 or later; rebuild or replace any locally compiled instances using the patched source.

How to confirm the fix worked

Confirm package version is at or above the listed fixed release using dpkg or apt; attempt to open a known-good .fst file and verify no crashes occur under AddressSanitizer or similar instrumentation.

Typical attack path

1. Craft malicious .fst file exploiting fstFread buffer handling
2. Deliver file via email, download, or shared storage
3. Victim opens file in vulnerable application
4. Overflow occurs during VCDATA block parsing
5. Arbitrary code execution achieved

How to detect it

Review file-open logs and process creation events for unexpected execution of the affected binary immediately after .fst file access; inspect crash dumps or core files containing fstReaderIterBlocks2 symbols.

What your security team should do

• Immediately update chromium on all Debian 12 systems to the fixed version
• Disable opening of untrusted .fst files via application policy or sandboxing until patched
• Monitor for new exploit samples and raise EPSS threshold alerts