Hi,

The following vulnerabilities were published for biosig.

CVE-2026-22891[0]:
| A heap-based buffer overflow vulnerability exists in the Intan CLP
| parsing functionality of The Biosig Project libbiosig 3.9.2 and
| Master Branch (db9a9a63). A specially crafted Intan CLP file can
| lead to arbitrary code execution. An attacker can provide a
| malicious file to trigger this vulnerability.


CVE-2026-20777[1]:
| A heap-based buffer overflow vulnerability exists in the Nicolet WFT
| parsing functionality of The Biosig Project libbiosig 3.9.2 and
| Master Branch (db9a9a63). A specially crafted .wft file can lead to
| arbitrary code execution. An attacker can provide a malicious file
| to trigger this vulnerability.


CVE-2025-64736[2]:
| An out-of-bounds read vulnerability exists in the ABF parsing
| functionality of The Biosig Project libbiosig 3.9.2 and Master
| Branch (5462afb0). A specially crafted .abf file can lead to an
| information leak. An attacker can provide a malicious file to
| trigger this vulnerability.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-22891
https://www.cve.org/CVERecord?id=CVE-2026-22891
[1] https://security-tracker.debian.org/tracker/CVE-2026-20777
https://www.cve.org/CVERecord?id=CVE-2026-20777
[2] https://security-tracker.debian.org/tracker/CVE-2025-64736
https://www.cve.org/CVERecord?id=CVE-2025-64736

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Dear all,

I can confirm these issues have been fixed in upstream in biosig 3.9.3
released in Feb 2026 and later. Biosig 3.9.5 has just been released and
has these fixed.



[1]
https://sourceforge.net/p/biosig/code/ci/3002bdc6f46225a4e76caefdd2444276e6c5b0a7/

[2]
https://sourceforge.net/p/biosig/code/ci/3002bdc6f46225a4e76caefdd2444276e6c5b0a7/

[3]
https://sourceforge.net/p/biosig/code/ci/718741c09e0b065b8ad0ebf66128a44899554930/

[4] https://pub.ista.ac.at/~schloegl/biosig/RELEASE-NOTES


Cheers,
    Alois

We believe that the bug you reported is fixed in the latest version of
biosig, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1130889@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andreas Tille <tille@debian.org> (supplier of updated biosig package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 26 Apr 2026 10:35:51 +0200
Source: biosig
Architecture: source
Version: 3.9.5-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org>
Changed-By: Andreas Tille <tille@debian.org>
Closes: 1112133 1122863 1124146 1130889
Changes:
 biosig (3.9.5-1) unstable; urgency=medium
 .
   * Team upload.
 .
   [ Andreas Tille ]
   * New upstream version
     Closes: #1112133, #1122863, #1130889
   * d/watch: version=5
   * New upstream version
   * Fix clean target
   * Remove Priority field to comply with Debian Policy 4.7.3 (routine-
     update)
   * Standards-Version: 4.7.4 (routine-update)
   * debputy lint --auto-fix (routine-update)
   * use pybuild
 .
   [ Santiago Vila ]
   * Build-Depends: python3-venv, python3-build
     Closes: #1124146
Checksums-Sha1:
 42c2990f5a1bb123d03a9f8030a518279d7ab3ca 2514 biosig_3.9.5-1.dsc
 6281a49a1dba58ee66fcbbd3e9d7c1b74188af40 1900140 biosig_3.9.5.orig.tar.xz
 9b9d2a69d8ddc3f849b8d66c7bb826824796eddd 15200 biosig_3.9.5-1.debian.tar.xz
 1c689d37cbb1b7ecf60d027311ef5fd1d1b8e381 27506 biosig_3.9.5-1_amd64.buildinfo
Checksums-Sha256:
 edfbdbc298f24287e1a3e05f0f7dbeccf91708dbd02319dffcf6b9c02cc5e02e 2514 biosig_3.9.5-1.dsc
 dfdb7aec5ac9681f25e3c186a5b356d5ec86cda87cdcb034d38e838f875cc3f1 1900140 biosig_3.9.5.orig.tar.xz
 fe8bfa68949d28719507c328b6178a4154b0a0c849640c34c14d926ae1c44e2f 15200 biosig_3.9.5-1.debian.tar.xz
 6af355783328483db28cee9434c90fcc0e792f486431572e36573946552492ad 27506 biosig_3.9.5-1_amd64.buildinfo
Files:
 1dea0c06068ed57f79b8653b1b6cef6e 2514 science optional biosig_3.9.5-1.dsc
 5cf2c7de4b91753f305a4f46aa44cc60 1900140 science optional biosig_3.9.5.orig.tar.xz
 19ce93966f283ba876f5f7bbfec17960 15200 science optional biosig_3.9.5-1.debian.tar.xz
 bacf2e711454ccb9f667dd6da15d426c 27506 science optional biosig_3.9.5-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEE8fAHMgoDVUHwpmPKV4oElNHGRtEFAmnt01IRHHRpbGxlQGRl
Ymlhbi5vcmcACgkQV4oElNHGRtGYWw/+Puek+tP6Sm4zDrSIqmCjC5r7YWjQMkZ6
aIVgkvaHuztIol8HuwLebG+9HxIJy3OGZ3hPHan/ppCqJwZSMz3CwZhyb2oF42WA
IGdjZWCPGrA7Z/mXgMy2UCAuG5ZT2rM22DSfMpterwQgFoOO1ST9l/Or8/+sf912
b3zh3fvWumvppNfmjmrymRNiLhaHEsJ2oNBkTbhQnQaWABdytpTcNR5WoGKQrvA4
r7LT1n5+E1PIJgwcFHBs7ozHOd2vhhnUgLARFmMZhFXhLUZ2U1X8mBrBHaycP/RP
+3tS80iHhT6ojHa+aRy8aTak+FOYLxNDAiUjno0PwBX9mZR5YCWtdQpLouYuR16E
o8iVQqEHgffe0Yi10TCQ1UI1oBdjpuc9x4EgzjiI3I/mnfLlZ4CDMUvDuS4u4dlC
JQ0So4aKX4RxunJxmu3qTuWZ8+9H7uhjMg/dxHlzUSV1LRW/lP/fY74ZCroBbTHM
lpZoT/RI9yUXMPy6KJOKXiLUAtSjKLkGAIPlytHiPcpzUtRAn6D2YJr25v5jfqlf
KbCrWQDMXevA3Onqj4yd1rsy/+861v+YJBpD/BldPzSjKP9HS7kMVVYD66GpCP7q
yJZXC2/awDOY4+aK5LWgk6QHR0dpTsiHbjOZpxM/2RdKsTVEH80WjCAuuy3A3j+z
cFuRnxUzato=
=q/BZ
-----END PGP SIGNATURE-----