CVE-2024-23809

The vulnerability (CWE-415) consists of double-freeing the same memory area during processing of the ASCII header in BrainVision format. The attacker delivers a malicious .vhdr file to the victim, whose opening by an application using libbiosig triggers a memory management error. Improper heap operations resulting from double-free can be exploited to take control of the program's execution flow and execute arbitrary code.

An attacker can gain full arbitrary code execution (RCE) in the context of the process handling the file, which may lead to violations of system confidentiality, integrity, and availability.

Patches available from the vendor should be applied in accordance with the references. It is recommended to monitor updates of the Biosig project and update the libbiosig package in the Fedora distribution in accordance with the announcement published on the package-announce mailing list. Avoid opening .vhdr files from untrusted sources.

The Biosig Project libbiosig 2.5.0 and Master branch (commit ab0ee111); Fedora (packages containing vulnerable libbiosig version)