libbiosig
CVE-2025-66043
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted MFER file to victim
-
DeliveryApplication parses file with libbiosig
-
ExploitOverflow stack buffer on Tag 3
-
ExecutionOverwrite return address/control data
-
ImpactExecute arbitrary code in parser context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that an application or workflow using libbiosig 3.9.1 parse an attacker-supplied MFER-format file in which the Tag field equals 3, which drives the vulnerable parsing path and overflows a stack buffer. The key limiting factors are: the target must actually process untrusted MFER files (a specialized biosignal format, not a ubiquitous document type), the malicious file must be delivered to and opened/ingested by that parser (implying user interaction or an automated file-processing pipeline), and only libbiosig 3.9.1 is confirmed affected. There is no indication of a privileged configuration being required; the realistic constraint is the narrow deployment of software that ingests MFER files from untrusted sources. |
| Impact | This is a stack-based buffer overflow (CWE-121) in the MFER file parser of libbiosig 3.9.1, reported by Cisco Talos with publicly available exploit/proof-of-concept detail (TALOS-2025-2296); KEV status is NOT present, so this is 'publicly available exploit code exists' rather than confirmed active exploitation. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) and the description conflict on a key point: the vulnerability is triggered by processing a 'specially crafted MFER file' that 'an attacker can provide,' which is a file-parsing flaw that in practice requires the victim to open or ingest the malicious file (user interaction and typically local delivery), yet the vector claims UI:N and AV:N - this likely inflates the base score, and the metrics should be verified against the realistic delivery path. The real-world signals are comparatively modest: EPSS is only 0.71% (52nd percentile), there is no KEV listing, and libbiosig is a niche biomedical-signal library rather than broadly internet-exposed infrastructure. Net assessment: a genuinely serious memory-corruption bug enabling code execution where the library parses untrusted files, but the headline 9.8 overstates mass-exploitation risk - prioritize for environments that parse untrusted MFER/biosignal files, while treating the AV:N/UI:N framing with skepticism. |
| Exploit ScenarioDerived | An attacker crafts a malicious MFER file with a Tag value of 3 that overflows a stack buffer during parsing and emails or otherwise delivers it to a victim running software that links libbiosig 3.9.1. When the file is opened or processed, the overflow corrupts the stack and executes attacker-controlled code with the privileges of the parsing process. A public Talos proof-of-concept/exploit report (TALOS-2025-2296) documents the flaw. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Arbitrary code execution in The Biosig Project libbiosig 3.9.1 occurs when the MFER parser processes a crafted MFER biosignal file whose Tag field equals 3, overflowing a fixed-size stack buffer (CWE-121). The attack is delivered by supplying a malicious MFER file to any application or workflow built on libbiosig 3.9.1, which makes this an unauthenticated (PR:N) but user-interaction-dependent (UI:R) issue under the assessed vector, rather than the unqualified network-exploitable 9.8 that the base NVD score implies. Exploitation status at time of analysis is 'publicly available exploit code exists' - Cisco Talos published the TALOS-2025-2296 report with exploit detail - but the CVE is not on CISA KEV, so active exploitation is not confirmed; EPSS is a modest 0.71% (52nd percentile), consistent with a niche format parser that is unlikely to be broadly targeted.
RemediationAI
No vendor-released patch was identified at time of analysis, and no fixed version number is provided in the available data, so the first action is to check the BioSig Project upstream release feed and the Cisco Talos advisory TALOS-2025-2296 (https://talosintelligence.com/vulnerability_reports/TALOS-2025-2296) for a patched libbiosig release published after 3.9.1 and upgrade as soon as one is available - do not assume any specific version fixes it until the vendor confirms. Until then, the most effective and lowest-cost control is to stop feeding untrusted MFER files to libbiosig-based software: disable MFER import in any user-facing upload or conversion feature, and if MFER support cannot be removed, gate it to trusted, pre-screened sources. Where MFER processing must continue, isolate it - run the parsing step in a disposable, unprivileged sandbox or container with no network egress, a read-only filesystem, and no access to secrets or other workloads, accepting that this reduces blast radius rather than preventing the crash. A targeted input filter that rejects or truncates MFER records with Tag equal to 3 before they reach the parser will block this specific code path, but it is format-specific, will break legitimate files that use that tag, and will not protect against other overflow paths in the same parser. General hardening such as stack canaries, ASLR, and non-executable stacks raises the exploitation bar and may convert code execution into a denial-of-service crash, but these are probabilistic mitigations against a CWE-121 flaw and should not be treated as a fix; similarly, avoiding the vulnerable code entirely by using a memory-safe parser or an external conversion service with strict output validation is worth considering where architecture allows.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libbiosig is the core C/C++ library of the BioSig Project, used to read, write and convert a wide range of biomedical signal formats (ECG, EEG, and other physiological waveform data). MFER (Medical waveform Format Encoding Rules) is one such format, a tag/length/value binary serialization in which each record is identified by a numeric tag; the parser dispatched on Tag 3 takes a length derived from the file and copies the associated payload into a fixed-size buffer allocated on the stack without adequate bounds validation. That is the classic CWE-121 stack-based buffer overflow pattern, and because the overwritten region is the stack frame itself the primitive can corrupt return addresses and adjacent locals, enabling arbitrary code execution in the process that performs the parsing. The CPE record cpe:2.3:a:libbiosig_project:libbiosig:*:*:*:*:*:*:*:* leaves the version field wildcarded, meaning the authoritative version constraint comes from the vendor/Talos reporting rather than from NVD CPE matching; the confirmed affected version is 3.9.1. The divergence between NVD's CVSS:3.1/AV:N/AC:L/PR:N/UI:N (9.8) and the independently assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:R (C:H/I:H/A:H) is explained by delivery reality: the flaw is not reachable over a raw network socket but through file ingestion, so an attacker must get the crafted MFER file to a target parser, which typically means a file-upload path, email attachment, or an automated conversion/signal-processing pipeline - hence the local vector and required user interaction.
Know when Libbiosig gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
File-parsing flaw triggered by a victim-supplied MFER file, so AV:L and UI:R rather than the input's AV:N/UI:N; code execution yields full C:H/I:H/A:H.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 3
Executive ViewAI
The Biosig Project libbiosig 3.9.1 is affected by a critical arbitrary code execution vulnerability in its MFER file parser, creating a risk of system compromise for organizations that process MFER biosignal files in clinical, research, or diagnostic workflows. Because no vendor patch is currently available and user interaction is required to trigger the flaw, affected teams should treat any ingestion of untrusted MFER files as a high-risk activity. Leadership should prioritize identifying exposed systems and reducing MFER file processing until a fixed release is available, while noting that public exploit code exists but active exploitation is not confirmed and overall exploitation likelihood remains low per EPSS.
No vendor patch available. Interim mitigations include disabling MFER parsing in libbiosig 3.9.1 where feasible, blocking untrusted MFER files at email and web gateways, sandboxing or isolating applications that process MFER files, enforcing least privilege for users and services, and monitoring for suspicious process execution from biosignal file handlers.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Arbitrary code execution can be achieved in The Biosig Project libbiosig 3.9.1 by supplying a crafted MFER file whose re
A stack-based buffer overflow in The Biosig Project's libbiosig 3.9.1 allows memory corruption that can lead to arbitrar
Arbitrary code execution in The Biosig Project libbiosig 3.9.1 stems from stack-based buffer overflows in the MFER parsi
Arbitrary code execution in The Biosig Project libbiosig 3.9.1, where a specially crafted MFER biosignal file triggers a
Stack-based buffer overflow in libbiosig 3.9.1's MFER parser allows arbitrary code execution when a crafted MFER file wi
An integer overflow vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.0 and Mast
Heap overflow in libbiosig 3.9.2 Intan CLP parsing. PoC available.
A double-free vulnerability exists in the BrainVision ASCII Header Parsing functionality of The Biosig Project libbiosig
An out-of-bounds write vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0
An integer underflow vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 an
A use-after-free vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Ma
An out-of-bounds write vulnerability exists in the BrainVisionMarker Parsing functionality of The Biosig Project libbios
GitHub PoC
Exploit-DB