CVE-2024-21795: 
Linux Debian vulnerability analysis and mitigation

A heap-based buffer overflow vulnerability (CVE-2024-21795) was discovered in The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). The vulnerability exists in the .egi parsing functionality of the software. This vulnerability was disclosed on February 20, 2024, and affects the core library used for processing medical signal data in various scientific software applications (Talos Report).

The vulnerability is classified as a heap-based buffer overflow (CWE-122, CWE-787) with a CVSS v3.1 base score of 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue occurs in the EGI file format parsing code where a static-length buffer allocation of 257*sizeof(*hdr->EVENT.CodeDesc) is made, but the code allows writing beyond this buffer based on a user-controlled NEC variable (Talos Report).

The vulnerability can lead to arbitrary code execution when processing specially crafted .egi files. Given that libbiosig is a core component in various biomedical signal processing applications, including Octave and Matlab APIs, sigviewer, and other scientific software, the impact could be significant for organizations processing medical signal data (Talos Report).

The vulnerability has been patched in version 2.6.0 of biosig4c++. Users are advised to upgrade to this version which includes fixes for CVE-2024-21795 along with several other security improvements (Fedora Update).