PT-2024-19062 · Biosig+1 · Libbiosig+1

Lilith >_> · Published 2024-02-20 · Updated 2025-08-10 · CVE-2024-21795

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Biosig Project libbiosig versions 2.5.0 through Master Branch (ab0ee111)

Description A heap-based buffer overflow vulnerability exists in the .egi parsing functionality. A specially crafted .egi file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Recommendations For versions 2.5.0 through Master Branch (ab0ee111), consider disabling the .egi parsing functionality until a patch is available. Restrict access to the .egi file parsing module to minimize the risk of exploitation. Avoid using specially crafted .egi files in the affected functionality until the issue is resolved.

Exploit

Fix

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

CVE-2024-21795

Affected Products

Debian

Libbiosig

References · 14

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2024-1920 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-21795 · Security Note
• https://ubuntu.com/security/CVE-2024-21795 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-21795 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-21795 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-21795 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21795 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/OIRLGNQM33KAWVWP5RPMAPHWNP3IY5YW · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-21795 · Vendor Advisory
• https://twitter.com/CVEnew/status/1759969329989497014 · Twitter Post
• https://t.me/cvenotify/71991 · Telegram Post
• https://sourceforge.net/p/biosig/code/ci/71057b016be545974565fdc0f903871c345da412 · Note
• https://t.me/cveNotify/131607 · Telegram Post
• https://twitter.com/cracbot/status/1760182636713312553 · Twitter Post