CVE-2024-21812

What it actually does

Integer overflow in sopen_FAMOS_read allows out-of-bounds write during parsing of a crafted .famos file, enabling arbitrary code execution.

Why it matters to the business

Attackers could gain full control of systems that process .famos files, leading to data theft, system compromise, or disruption of operations that rely on this library.

How an attack unfolds

An attacker creates a malicious .famos file that triggers the integer overflow during parsing; when the target application opens the file, the resulting out-of-bounds write is used to execute attacker-supplied code.

How to fix it

Upgrade libbiosig to a version that corrects the integer overflow in sopen_FAMOS_read; until available, avoid processing untrusted .famos files.

How to confirm the fix worked

Confirm the installed libbiosig version is newer than the vulnerable release and test file parsing against known-good and crafted .famos samples in a controlled environment.

Typical attack path

1. Craft a .famos file containing values that trigger integer overflow in FAMOS reader
2. Deliver the file to a target system via email, download, or shared storage
3. Victim application or library opens and parses the file
4. Overflow causes out-of-bounds write and arbitrary code execution

How to detect it

Review application logs and crash reports for unexpected terminations or errors while processing .famos files; inspect file-handling code paths for calls to the FAMOS reader.

What your security team should do

• Identify all applications and services that depend on libbiosig and schedule upgrades
• Block or sandbox processing of .famos files from untrusted sources until patched
• Add .famos file handling to threat-modeling and code-review processes