libbiosig CVE-2025-66044

Exploitation requires the victim application, service, or user to parse an attacker-supplied, specially crafted MFER file in which the structure identified by Tag 64 is malformed, triggering the stack-based buffer overflow in libbiosig 3.9.1's MFER parser. The key limiting factor is file delivery and processing: an attacker cannot reach the vulnerable code purely over the network without something ingesting the malicious MFER input, so exposure is confined to systems that accept and parse untrusted biosignal files (e.g., research tools, conversion pipelines, or clinical software embedding libbiosig). No authentication to the library itself is needed, but the requirement to get a crafted file parsed contradicts the input vector's UI:N and materially constrains real-world exploitability.

Signals are mixed and require careful interpretation. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8 Critical) describes a remote, unauthenticated, no-interaction compromise, but the description - 'An attacker can provide a malicious file to trigger these vulnerabilities' - is a classic file-parsing flaw that realistically requires a victim or automated pipeline to process an attacker-supplied MFER file. The AV:N/UI:N encoding therefore overstates exposure; this is almost certainly a local/file-delivery issue with required user interaction, which lowers real-world risk below the headline 9.8. Supporting this, EPSS is only 0.55% (44th percentile), indicating low modeled probability of widespread exploitation, and the vulnerability is NOT in CISA KEV (no confirmed active exploitation). Publicly available exploit/detail from Cisco Talos (TALOS-2025-2296) does raise the floor on attacker capability - reliable crash and likely code-execution details exist - so this should be treated as a real, patch-worthy memory-corruption bug (CWE-121 stack overflow, arbitrary code execution in the parsing process), but as a targeted/opportunistic file-attack rather than a wormable network threat. Net: a genuinely serious code-execution vulnerability in affected deployments, but the 'network, zero-click' framing is misleading and the low EPSS plus absence of KEV argue against emergency prioritization outside environments that actually ingest untrusted MFER files.

An attacker crafts a malicious MFER biosignal file with a malformed Tag 64 structure and delivers it to a victim (via email, upload portal, or a batch-conversion service that uses libbiosig). When the file is parsed, the stack-based buffer overflow is triggered, corrupting the stack and allowing arbitrary code execution in the context of the parsing process. A public technical report and exploit detail exist from Cisco Talos, lowering the barrier to weaponization.