A heap-based buffer overflow exists in the Intan CLP parsing routine of libbiosig 3.9.2. The flaw, classified as CWE-122, allows an attacker to supply a specially crafted CLP file that overwrites memory and can lead to arbitrary code execution. This compromise threatens confidentiality, integrity, and availability of the affected system.

The Biosig Project libbiosig version 3.9.2 and the master branch (commit db9a9a63) are affected. Any system that loads Intan CLP files through libbiosig is at risk. No other vendors or product versions are listed as impacted.

The vulnerability scores a CVSS base score of 9.8, indicating critical severity, yet its EPSS score is below 1%, suggesting low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker must provide a malicious CLP file to the parsing routine; therefore the likely attack vector is local or remote file upload/processing within an application that uses libbiosig.