CVE-2024-22097

What it actually does

Double-free condition during BrainVision header parsing of .vdhr files in libbiosig allows an attacker-supplied file to corrupt memory and achieve arbitrary code execution.

Why it matters to the business

Systems that parse untrusted .vdhr files risk remote compromise, data theft, or ransomware deployment; although exploitation remains uncommon, the high severity means any unpatched installation in medical or research workflows represents a significant operational risk.

How an attack unfolds

An attacker creates a malformed .vdhr file that triggers the double-free during header parsing; the file is delivered to a target application that links against the vulnerable libbiosig library, causing memory corruption that is turned into code execution.

How to fix it

Upgrade libbiosig to a version containing the fix for the BrainVision header parser; rebuild and redeploy all dependent applications; remove or quarantine any remaining copies of the vulnerable master branch or 2.5.0 release.

How to confirm the fix worked

Confirm the installed libbiosig version is newer than the affected commits; run the library's test suite against known-good and crafted .vdhr samples; monitor process memory for double-free crashes during parsing.

Typical attack path

1. Craft a .vdhr file containing a malicious BrainVision header
2. Deliver the file via email, download, or shared storage
3. Victim application opens the file and invokes libbiosig parsing
4. Double-free corrupts heap structures
5. Attacker-controlled data leads to arbitrary code execution

How to detect it

Search application and system logs for unexpected crashes or errors while processing .vdhr files; inspect process dumps or sanitizer reports for double-free signatures in the BrainVision parsing path; correlate file-creation events with subsequent suspicious process behavior.

What your security team should do

• Prioritize inventory of all applications linking libbiosig and schedule immediate updates
• Block or sandbox processing of .vdhr files from untrusted sources until patched
• Add .vdhr file handling to threat-hunting playbooks and SIEM rules