CVE-2026-123976 · Package
NO FIX YET · SEE WHAT TO DO
EDFbrowser before 2.16 has an out-of-bounds write in check_edf_file() caused by a fixed 256-element annotation array. A crafted EDF+ or BDF+ file with more than 256 annotation signals overwrites header structure members, crashing the application when the file is opened.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Anyone running EDFbrowser older than 2.16 who opens EDF+ or BDF+ files, especially files from untrusted sources. The sources describe a crash on opening; they do not describe code execution, so the exposure is mainly to researchers and clinicians who open third-party recordings.
Not affected if no-untrusted-edf-files, version-2.16-or-later
Who cares edfbrowser, medical-signal-analysis
2.16.2.16 or later (the sources state the fix is in versions before 2.16 being affected).EDFbrowser before 2.16 contains an out-of-bounds write vulnerability in check_edf_file() that allows attackers to overflow the 256-element annot_ch array by supplying excessive annotation signals. Attackers can craft an EDF+ or BDF+ file with more than 256 annotation signals to overwrite edfhdrblock members, including the signal parameter pointer, crashing the application when opened.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.