PT-2024-19204 · Biosig+1 · Libbiosig+1

Lilith >_> · Published 2024-02-20 · Updated 2025-08-10 · CVE-2024-22097

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Biosig Project libbiosig versions 2.5.0 and Master Branch (ab0ee111)

Description A double-free vulnerability exists in the BrainVision Header Parsing functionality. This can be triggered by a specially crafted .vdhr file, potentially leading to arbitrary code execution. An attacker can exploit this by providing a malicious file.

Recommendations For version 2.5.0, consider disabling the BrainVision Header Parsing functionality until a patch is available. For Master Branch (ab0ee111), restrict the use of the BrainVision Header Parsing functionality to minimize the risk of exploitation. Avoid using malicious .vdhr files with the affected software until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2024-22097

Affected Products

Debian

Libbiosig

References · 14

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2024-1917 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-22097 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-22097 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22097 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22097 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-22097 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/OIRLGNQM33KAWVWP5RPMAPHWNP3IY5YW · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-22097 · Security Note
• https://ubuntu.com/security/CVE-2024-22097 · Vendor Advisory
• https://twitter.com/CVEnew/status/1759969326457819457 · Twitter Post
• https://twitter.com/cracbot/status/1760182639905136652 · Twitter Post
• https://sourceforge.net/p/biosig/code/ci/3848d1ca0e1b2a60df395ddc76a191e835a1e4de · Note
• https://t.me/cvenotify/71993 · Telegram Post
• https://t.me/cveNotify/131609 · Telegram Post