CVE-2024-23606: fedora Memory Corruption — Exploit

Description

An out-of-bounds write vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .famos file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Is your site exposed to CVE-2024-23606?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-131 CWE-131

CWE-787 Out-of-bounds Write

Affected Products

Vendor	Product	Versions
libbiosig_project	libbiosig	All
fedoraproject	fedora	All

References

Exploits

https://talosintelligence.com/vulnerability_reports/TALOS-2024-1925 https://talosintelligence.com/vulnerability_reports/TALOS-2024-1925

Other References

https://lists.fedoraproject.org/archives/list/[email protected]/message/OIRLGNQM33KAWVWP5RPMAPHWNP3IY5YW/ https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1925

Frequently Asked Questions

What is CVE-2024-23606? +

An out-of-bounds write vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .famos file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. It has a CVSS v3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2024-23606? +

CVE-2024-23606 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

What products are affected by CVE-2024-23606? +

CVE-2024-23606 affects products from fedoraproject, libbiosig_project, specifically: fedora, libbiosig. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-23606? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-46723

OpenVM is a performant and modular zkVM framework built for customization and extensibility. In version 1.0.0, OpenVM is vulnerable to …

CVE-2026-107590

An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in …

CVE-2026-45784

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers …

CVE-2026-95111

A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer …

CVE-2026-102729

`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds …

CVE-2026-11604

An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote …