CVE-2024-22097

The error occurs in the module responsible for parsing BrainVision format headers (.vhdr files) in the libbiosig library. During processing of such a file, the same memory area is freed twice (double-free), leading to heap corruption. The attacker provides the victim with a specially crafted .vhdr file, which when opened by an application using libbiosig triggers the vulnerability and may result in arbitrary code execution.

Successful exploitation of the vulnerability allows an attacker to execute arbitrary code in the context of the process handling the file, which may lead to complete system compromise, data disclosure, or system destabilization.

Patches available from the vendor should be applied in accordance with the references. It is recommended to update to the patched version of libbiosig indicated by The Biosig Project and install updated packages in Fedora systems according to the message published on the package-announce mailing list. Avoid opening .vhdr files from untrusted sources until patches are deployed.

The Biosig Project libbiosig Master branch (commit ab0ee111) and version 2.5.0, as well as libbiosig packages provided by Fedora Project Fedora.