CVE-2023-35960

What it actually does

OS command injection in decompression functionality allowing arbitrary command execution via a specially crafted wave file opened in the application.

Why it matters to the business

Potential full system compromise if users open malicious files, though low urgency given stable low EPSS, no KEV listing, and no ransomware association; affects chromium users on Debian 12 with many downstream dependents.

How an attack unfolds

An attacker creates a malicious wave file exploiting legacy decompression in vcd_main; the victim opens the file triggering command execution. Exploit code is publicly available with no named threat actors observed.

How to fix it

Upgrade chromium on Debian 12 to version 126.0.6478.56-1~deb12u1 or later; avoid opening untrusted wave files until patched.

How to confirm the fix worked

Verify package version is at or above 126.0.6478.56-1~deb12u1 and test with known malicious wave samples in a controlled environment to confirm no command execution occurs.

Typical attack path

1. Create malicious wave file embedding OS commands
2. Distribute the file to target users
3. User opens the file in the vulnerable application
4. Arbitrary commands execute on the host

How to detect it

Review application logs and system process creation events around file open operations for signs of unexpected command execution; check for legacy decompression paths being invoked on wave files.

What your security team should do

• Prioritize patching chromium installations on Debian 12 to the fixed version
• Monitor for new exploit releases given public availability
• Educate users on risks of opening untrusted wave files