CVE-2026-20777
Published: 03 March 2026
Description
A heap-based buffer overflow vulnerability exists in the Nicolet WFT parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63). A specially crafted .wft file can lead to arbitrary code execution. An attacker can provide a malicious file…
more
to trigger this vulnerability.
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the known heap-based buffer overflow in libbiosig's WFT parsing by requiring timely identification, reporting, and correction of the flaw.
Implements memory protections such as address space randomization and non-executable memory to prevent arbitrary code execution from heap buffer overflows triggered by crafted .wft files.
Requires validation of .wft file inputs to the libbiosig parser to reject specially crafted files that would trigger the buffer overflow vulnerability.
Security SummaryAI
A heap-based buffer overflow vulnerability, tracked as CVE-2026-20777 and published on 2026-03-03, affects the Nicolet WFT parsing functionality in The Biosig Project's libbiosig version 3.9.2 and the master branch at commit db9a9a63. This flaw, classified under CWE-122, carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Processing a specially crafted .wft file triggers the overflow, potentially leading to arbitrary code execution.
Remote attackers require no privileges or user interaction but must craft a file with high complexity to exploit this over a network. Successful exploitation grants high confidentiality, integrity, and availability impacts, enabling full arbitrary code execution in the context of the affected libbiosig process.
Mitigation details are available in the associated advisories from Talos Intelligence, referenced at https://talosintelligence.com/vulnerability_reports/TALOS-2026-2362 and https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2362.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap-based buffer overflow triggered by parsing a crafted .wft file enables arbitrary code execution, directly mapping to Exploitation for Client Execution (T1203).