CVE-2024-23305: 
Linux Debian vulnerability analysis and mitigation

An out-of-bounds write vulnerability (CVE-2024-23305) exists in the BrainVisionMarker Parsing functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). The vulnerability was discovered by Lilith >_> of Cisco Talos and publicly disclosed on February 20, 2024. The affected software, libbiosig, is an open-source library designed to process various types of medical signal data (EKG, EEG, etc.) within different file formats (Talos).

The vulnerability is classified as an out-of-bounds write issue that occurs during the parsing of .vmrk files. The vulnerability has received a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue is tracked under CWE-787 (Out-of-bounds Write). The vulnerability exists in the parsing code of the BrainVision file format, specifically when processing .vmrk marker files (Talos).

If successfully exploited, this vulnerability can lead to arbitrary code execution on the targeted system. The vulnerability affects systems processing medical signal data, potentially impacting healthcare organizations and research institutions that use the libbiosig library for processing biomedical signals (Talos).

The vulnerability has been addressed in version 2.6.0 of biosig4c++. Users are advised to upgrade to this version which includes security fixes for CVE-2024-23305 and several other vulnerabilities (Fedora).