CVE-2026-20777
Heap-Based Buffer Overflow in libbiosig Nicolet WFT Parsing Enables Code Execution
Publication date: 2026-03-03
Last updated on: 2026-03-05
Assigner: Talos
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| libbiosig_project | libbiosig | 3.9.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-20777 is a heap-based buffer overflow vulnerability in The Biosig Project's libbiosig library, specifically in the Nicolet WFT file parsing functionality."}, {'type': 'paragraph', 'content': "The vulnerability occurs when the parser copies the 'Nicolet_Digitizer_Type' field from a specially crafted .wft file into a fixed-size heap buffer without proper bounds checking. The code uses an unsafe strcpy call starting at an offset in the buffer, which can overflow if the input string is longer than expected."}, {'type': 'paragraph', 'content': 'This overflow can overwrite adjacent heap memory and metadata, potentially allowing an attacker to execute arbitrary code by providing a malicious .wft file.'}] [1]
How can this vulnerability impact me? :
This vulnerability can lead to arbitrary code execution on systems using the vulnerable libbiosig library when processing maliciously crafted .wft files.
An attacker can exploit this by supplying a specially crafted file that triggers the heap buffer overflow, potentially compromising the confidentiality, integrity, and availability of the affected system.
- Remote code execution without requiring privileges or user interaction.
- High impact on confidentiality, integrity, and availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by identifying the presence of the vulnerable libbiosig library (version 3.9.2 or the master branch db9a9a63) and monitoring for the processing of specially crafted .wft files that contain an overly long Nicolet_Digitizer_Type field.'}, {'type': 'paragraph', 'content': 'Since the vulnerability is triggered by parsing malicious .wft files, one detection method is to scan for suspicious .wft files with abnormally long header fields.'}, {'type': 'paragraph', 'content': 'Suggested commands to detect potential exploitation attempts or presence of malicious files include:'}, {'type': 'list_item', 'content': 'Use file inspection tools to identify .wft files and check the length of the Nicolet_Digitizer_Type field. For example, using `xxd` or `hexdump` to inspect the header bytes.'}, {'type': 'list_item', 'content': 'Search for .wft files with unusually large header fields using commands like `grep` or `strings` combined with length checks.'}, {'type': 'list_item', 'content': 'Monitor application logs or use debugging tools (e.g., AddressSanitizer) to detect heap-buffer-overflow errors during file parsing.'}, {'type': 'list_item', 'content': "Example command to find .wft files larger than expected (assuming suspiciously large files might be malicious): `find /path/to/files -name '*.wft' -size +1k`"}] [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include:
- Avoid processing untrusted or unauthenticated .wft files with the vulnerable versions of libbiosig.
- Apply patches or updates to libbiosig that fix the heap-based buffer overflow vulnerability if available.
- Implement input validation to ensure that the Nicolet_Digitizer_Type field does not exceed the fixed buffer size before parsing.
- Use security tools such as AddressSanitizer or other memory error detectors during development or testing to catch buffer overflows.
- Restrict network access or file uploads to systems using the vulnerable libbiosig library to trusted sources only.