Out-of-bounds write in EDFbrowser annotation signal handling
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
EDFbrowser before 2.16 contains an out-of-bounds write in check_edf_file() that lets attackers overflow the 256-element annot_ch array by supplying excessive annotation signals. An attacker who gets a user to open a crafted EDF+ or BDF+ file with more than 256 annotation signals can overwrite edfhdrblock members, crashing the application. The flaw is classified as CWE-787.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
EDFbrowser before 2.16 contains an out-of-bounds write vulnerability in check_edf_file() that allows attackers to overflow the 256-element annot_ch array by supplying excessive annotation signals. Attackers can craft an EDF+ or BDF+ file with more than 256 annotation signals to overwrite edfhdrblock members, including the signal parameter pointer, crashing the application when opened.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Teunis van Beelen | EDFbrowser | before 2.16 | 2.16 | Patch available | CNA |
- EDFbrowser VendorTeunis van Beelen Affected before 2.16 Fixed in 2.16 Patch available CNA
Remediation
Update Teunis van Beelen EDFbrowser to version 2.16 or later, which fixes the flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA EDFbrowser (Teunis van Beelen) Fixed in 2.16
Timeline
- 2026-11-06 Threatist record created from CVE-2026-123976
- 2026-11-06 Alias added: GHSA-26mh-qcgf-vfgg
- 2026-11-08 Priority changed: MEDIUM → LOW
References
Sources
- CVE-2026-123976 · CVE Program
- CVE-2026-123976 · NVD
- FIRST EPSS
- GHSA-26mh-qcgf-vfgg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences