{"id":"CVE-2026-20777","aliases":["DEBIAN-CVE-2026-20777","EUVD-2026-9291","GHSA-2gq5-x5qp-v68m","UBUNTU-CVE-2026-20777","USN-8713-1"],"status":"published","title":"A heap-based buffer overflow vulnerability exists in the Nicolet WFT parsing functionality of The...","description":"A heap-based buffer overflow vulnerability exists in the Nicolet WFT parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63). A specially crafted .wft file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00587,"percentile":0.48536,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2026-03-03T14:32:14Z","modified":"2026-10-01T03:02:57Z","fixes":[{"ecosystem":"Debian:14","package":"biosig","fixed_in":["3.9.5-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"biosig","fixed_in":["2.6.0-1ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"biosig","fixed_in":["3.9.0-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"biosig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.0-1","2.5.2-1","2.5.2-2","2.6.0-1","2.6.1-1","3.9.0-1","3.9.5-1"]},{"source":"osv","ecosystem":"Debian:13","package":"biosig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.0-1","3.9.5-1"]},{"source":"osv","ecosystem":"Debian:14","package":"biosig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.5-1"}]}],"versions":["3.9.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"biosig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1ubuntu1+esm1"}]}],"versions":["2.5.0-1build2","2.5.2-1","2.5.2-1build1","2.5.2-2","2.6.0-1","2.6.0-1build1","2.6.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"biosig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.1-1build3","3.9.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"biosig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-1ubuntu0.1~esm1"}]}],"versions":["3.9.0-1","3.9.0-1build1","3.9.0-1build2","3.9.0-1build3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"biosig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-1ubuntu0.1~esm1"}]}],"versions":["2.1.2-4","2.1.2-4build1","2.1.2-4build2","2.3.3-1","2.3.3-1build1","2.3.3-1build2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"biosig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1ubuntu1+esm1"}]}],"versions":["2.5.0-1build2","2.5.2-1","2.5.2-1build1","2.5.2-2","2.6.0-1","2.6.0-1build1","2.6.0-1ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"biosig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-1ubuntu0.1~esm1"}]}],"versions":["3.9.0-1","3.9.0-1build1","3.9.0-1build2","3.9.0-1build3"],"bundled":2}],"products":[{"vendor":"libbiosig_project","product":"libbiosig"},{"vendor":"the biosig project","product":"libbiosig"}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2362","tags":["Exploit","Third Party Advisory","evidence","report"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2362","tags":["Exploit","Third Party Advisory","evidence","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20777"},{"url":"https://github.com/advisories/GHSA-2gq5-x5qp-v68m"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-20777","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-20777","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8713-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-20777","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22891","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-20777","description":"A heap-based buffer overflow vulnerability exists in the Nicolet WFT parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63). A specially crafted .wft file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2026-03-03T14:32:14.987Z","modified":"2026-03-03T15:17:02.898Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T13:35:44.571002Z"}],"euvd":[{"id":"EUVD-2026-9291","description":"A heap-based buffer overflow vulnerability exists in the Nicolet WFT parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63). A specially crafted .wft file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2026-03-03T14:32:14Z","modified":"2026-03-03T15:17:02Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:12.247854Z"}],"ghsa":[{"id":"GHSA-2gq5-x5qp-v68m","title":"A heap-based buffer overflow vulnerability exists in the Nicolet WFT parsing functionality of The...","description":"A heap-based buffer overflow vulnerability exists in the Nicolet WFT parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63). A specially crafted .wft file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2026-03-03T15:31:40Z","modified":"2026-03-03T18:31:33Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:06:26.357639Z"}],"nvd":[{"id":"CVE-2026-20777","description":"A heap-based buffer overflow vulnerability exists in the Nicolet WFT parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63). A specially crafted .wft file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2026-03-03T15:16:18.187Z","modified":"2026-06-17T10:17:47.187Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:12:07.420927Z"}],"osv":[{"id":"CVE-2026-20777","description":"A heap-based buffer overflow vulnerability exists in the Nicolet WFT parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63). A specially crafted .wft file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2026-03-03T15:16:18.187Z","modified":"2026-04-10T05:38:19.745611Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:58.42038Z"},{"id":"DEBIAN-CVE-2026-20777","description":"A heap-based buffer overflow vulnerability exists in the Nicolet WFT parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63). A specially crafted .wft file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2026-03-03T15:16:18.187Z","modified":"2026-10-01T03:02:57.748794086Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"UBUNTU-CVE-2026-20777","description":"A heap-based buffer overflow vulnerability exists in the Nicolet WFT parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63). A specially crafted .wft file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2026-03-03T15:16:00Z","modified":"2026-09-02T19:35:30.3178394Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"USN-8713-1","title":"biosig vulnerabilities","description":"Mark Bereza and Lilith Wyatt discovered that BioSig incorrectly handled certain crafted input\nfiles. An attacker could possibly use this issue to cause a denial of \nservice or execute arbitrary code. (CVE-2026-22891, CVE-2026-20777)","status":"published","published":"2026-09-02T14:04:35Z","modified":"2026-09-03T01:26:34.755834611Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}