CVE Intelligence
Analysis AI-assisted

CVE-2026-22891: Biosig Project libbiosig Intan CLP Heap-based Buffer Overflow

The libbiosig library from The Biosig Project contains a heap-based buffer overflow in its Intan CLP parsing code. According to the CNA Talos, a specially crafted Intan CLP file could lead to arbitrary code execution in the affected version 3.9.2 and the master branch. The record lists no fixed version, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The libbiosig library from The Biosig Project has a heap-based buffer overflow (CWE-122) in its parser for Intan CLP files. The CNA Talos published the issue as TALOS-2026-2361 and assigned a CVSS base score of 9.8 (critical).

Impact

  • The record describes arbitrary code execution as the potential consequence of processing a crafted Intan CLP file.
  • The CNA vector describes a network attack requiring no privileges and no user interaction, with high impact to confidentiality, integrity and availability.
  • Practical exposure depends on whether applications built on libbiosig parse files from untrusted sources.

Affected products and versions

  • libbiosig version 3.9.2, as listed in the record.
  • The master branch at commit db9a9a63, as listed in the record.
  • The record lists no fixed version. Whether a patched release exists is unknown.

Exploitation status

  • This CVE is not listed in the CISA KEV catalog in the record, so active exploitation is not confirmed by that source.
  • No confirmed exploitation appears in the sources consulted.
  • The Talos references carry an Exploit tag in NVD metadata. That tag does not by itself confirm exploitation in the wild.
  • The SSVC exploitation field is none, and the EPSS probability is 0.00613 with a percentile of 0.48709.

Remediation and mitigation

  • Inventory systems, scripts and pipelines that use libbiosig 3.9.2 or the master branch.
  • Until a fixed release is confirmed, treat Intan CLP files from untrusted sources as hostile. Restrict intake and process them in isolated environments with least privilege.
  • Monitor the Talos advisory and the project for a fixed version, and update when one is published.

Detection guidance

  • Watch for unexpected crashes or memory errors in processes that parse Intan CLP files.
  • Log and review the ingestion of external Intan CLP files.
  • Detection signatures for this specific issue are not included in the record.

Limitations of the available information

  • The record does not list fixed versions, the exact vulnerable code location, or vendor patches.
  • The record contains two Talos reference URLs that differ only in the www prefix.
  • No exploitation details are provided here, and the record's exploit tags are not explained.

Frequently asked questions

What is the vulnerability in CVE-2026-22891?

It is a heap-based buffer overflow in the Intan CLP parsing code of libbiosig, which the CNA Talos reports can lead to arbitrary code execution when a crafted file is processed.

Is there a fixed version available?

The record does not list any fixed version, so whether a patch exists is unknown. Monitor the Talos advisory and the project for updates.

Is this vulnerability being actively exploited?

This CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.