CVE-2024-23313

What it actually does

Integer underflow in sopen_FAMOS_read allows specially crafted .famos input to trigger an out-of-bounds write, enabling arbitrary code execution.

Why it matters to the business

Processing untrusted .famos files on affected systems can result in complete compromise, allowing attackers to run malicious code, steal data, or deploy ransomware without user interaction beyond opening the file.

How an attack unfolds

An attacker creates a malicious .famos file that triggers an integer underflow during FAMOS format parsing; when a vulnerable application opens the file the underflow leads to an out-of-bounds write that overwrites memory with attacker-controlled data, achieving arbitrary code execution.

How to fix it

Upgrade libbiosig to a patched release that corrects the integer underflow in sopen_FAMOS_read; until patches are available, avoid opening untrusted .famos files and consider sandboxing or file-type blocking.

How to confirm the fix worked

Confirm the installed libbiosig version is newer than the affected 2.5.0 / ab0ee111 commit; attempt to open a known-good .famos file after upgrade and monitor for crashes or unexpected behavior.

Typical attack path

1. Craft a .famos file that triggers the integer underflow in sopen_FAMOS_read
2. Deliver the file via email attachment, download link, or shared storage
3. Victim application opens the file using the vulnerable libbiosig library
4. Integer underflow causes out-of-bounds write and arbitrary code execution

How to detect it

Review application crash logs and process dumps for abnormal behavior during .famos parsing; inspect file-handling audit logs for unexpected execution or memory corruption indicators after .famos files are opened.

What your security team should do

• Prioritize patching libbiosig across all systems that parse .famos files
• Implement file-type restrictions or sandboxing for untrusted scientific data files
• Monitor for new upstream releases and update EPSS/KEV tracking as exploit maturity changes