CVE-2024-23305

What it actually does

Out-of-bounds write during BrainVisionMarker parsing of .vmrk files in libbiosig allows memory corruption that can be leveraged for arbitrary code execution.

Why it matters to the business

Processing untrusted biosignal files on affected systems can result in full host compromise, enabling data theft, ransomware deployment, or persistent access in research, clinical, or analytics environments.

How an attack unfolds

An attacker supplies a specially crafted .vmrk file to any application that uses the vulnerable libbiosig library; when the file is parsed, the out-of-bounds write occurs and attacker-controlled code is executed with the privileges of the processing application.

How to fix it

Upgrade libbiosig to a version that contains the fix for the BrainVisionMarker parser once released; until then, disable processing of .vmrk files from untrusted sources and run file-handling processes under least-privilege accounts or in sandboxed environments.

How to confirm the fix worked

Confirm the installed libbiosig version is newer than the affected 2.5.0/master branch, recompile dependent applications against the patched library, and test parsing of both benign and previously crashing .vmrk samples for absence of memory errors.

Typical attack path

1. Attacker creates malicious .vmrk file exploiting the marker parsing flaw
2. Malicious file is delivered to the target via email, download, or shared storage
3. Victim application or script opens and parses the file with libbiosig 2.5.0 or master branch
4. Out-of-bounds write corrupts memory and redirects execution to attacker payload

How to detect it

Monitor application and system logs for segmentation faults, heap corruption warnings, or abnormal exits when .vmrk files are processed; inspect process creation events immediately following .vmrk parsing activity.

What your security team should do

• Prioritize patching libbiosig in all pipelines that ingest .vmrk files
• Block or quarantine .vmrk attachments at mail and file gateways until patches are deployed
• Add runtime sandboxing or seccomp filters around biosig-dependent processes
• Update vulnerability scanners and SBOM tools to flag the affected library versions