libbiosig
CVE-2025-66045
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted MFER file to victim
-
ExploitApplication parses file with libbiosig
-
ExecutionOverflow stack buffer via Tag 65 field
-
ImpactExecute arbitrary code in app context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a system or user process an attacker-supplied, specially crafted MFER file with libbiosig 3.9.1, specifically triggering the vulnerable code path when the MFER Tag equals 65. The limiting factors are significant: the attacker must get the malicious file into a parsing workflow (email attachment, upload, shared dataset, or an automated ingestion service), and the target application must actually invoke libbiosig's MFER parser on that untrusted input. There is no evidence of remote service exposure; this is a file-format parsing flaw, so exploitation is bounded by whether the deployment ever reads untrusted biosignal files. This materially limits realistic risk versus the raw 9.8 score. |
| Impact | The input assigns a CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and the finding is a CWE-121 stack-based buffer overflow enabling arbitrary code execution, with publicly available exploit code (POC=YES, Talos TALOS-2025-2296). However, the signals conflict: the description explicitly states 'An attacker can provide a malicious file to trigger these vulnerabilities,' which is a classic file-parsing flaw that normally requires a local file and user/application interaction to open or process it - this contradicts the AV:N/UI:N rating that produced the 9.8 score. CVSS vector indicates network, no-interaction exploitation, but the description implies attacker-supplied-file (local/UI-dependent) access - verify with vendor; realistically this is closer to a local file-parsing bug (AV:L/UI:R). The EPSS score is low at 0.55% (44th percentile) and the CVE is NOT in CISA KEV, so despite a public POC there is no evidence of active or widespread exploitation. Net assessment: a genuinely serious memory-corruption/RCE bug with public exploit code, but real-world mass-exploitation risk is tempered by its file-parsing nature, the niche deployment of libbiosig, and the low EPSS - prioritize for environments that ingest untrusted MFER/biosignal files, but it is not a drop-everything internet-facing worm candidate. |
| Exploit ScenarioDerived | An attacker crafts a malicious MFER file containing an oversized field under Tag 65 and delivers it to a victim or system that uses libbiosig 3.9.1 to parse biosignal data. When the file is opened or processed, the stack-based buffer overflow is triggered, allowing arbitrary code execution in the context of the parsing application. Public exploit/analysis detail is available via Talos (TALOS-2025-2296). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Arbitrary code execution in The Biosig Project libbiosig 3.9.1, where a specially crafted MFER biosignal file triggers a stack-based buffer overflow (CWE-121) in the MFER tag-parsing code path when the parsed tag equals 65. The assessed vector is local with user interaction required (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rather than the remote 9.8 score filed by NVD: an attacker must deliver the malicious file and have the victim process or application actually hand it to libbiosig's MFER parser, so exploitation is bounded by whether a deployment ingests untrusted biosignal files. Publicly available exploit code exists through the Talos report TALOS-2025-2296, but there is no confirmed active exploitation (no CISA KEV listing) and EPSS is low at 0.55% (44th percentile), making real-world risk contingent on exposure of MFER parsing workflows to attacker-supplied input.
RemediationAI
No vendor-released patch for libbiosig 3.9.1 is identified in the available data, so the primary action is to track The Biosig Project upstream releases and the Talos advisory TALOS-2025-2296 (https://talosintelligence.com/vulnerability_reports/TALOS-2025-2296) and upgrade to the first release published after 3.9.1 that fixes the MFER Tag 65 handler; until then, compensating controls are mandatory. Stop feeding untrusted MFER files to libbiosig-based parsers: reject or quarantine MFER uploads at the application boundary and convert or validate them with a trusted, independent tool before ingestion, accepting the trade-off that legitimate biosignal waveform data may be delayed or rejected. Where MFER parsing is not a hard requirement, disable or unlink the MFER reader entirely, losing waveform import capability but eliminating the attack surface. For workflows that must parse third-party MFER files, run the parser in a hardened, low-privilege sandbox (container or VM with no network access, no credentials, read-only filesystem and seccomp/AppArmor confinement) sized so that a crash or code-execution attempt cannot reach production data or the network; the trade-off is increased operational complexity and potential throughput loss. Ensure ASLR and stack canaries are enabled for any binary embedding the library, restrict which users and services can invoke the parser, and review or fuzz the Tag 65 handling code to add an explicit length check before the stack copy. Monitor for crashes in libbiosig-linked processes as a detection signal, and re-check the upstream repository for a patch on a regular cadence since absence of a fixed version today is not confirmation that none will be published.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libbiosig is an open-source C/C++ library for reading and writing biomedical signal formats (EDF/BDF, GDF, MFER and many others) and is widely embedded in research and clinical biosignal tooling. MFER (Medical waveform Format Encoding Rules) is a tag-length-value binary format for waveform data such as ECG, in which each tag carries an identifier byte, a length and a payload; here the vulnerable path is reached when the parsed tag is 65, and the handler performs a copy into a fixed-size stack buffer without validating the incoming length against the buffer size. That is the classic CWE-121 stack-based buffer overflow: an oversized write corrupts adjacent stack memory, which under the assessed conditions (AV:L/AC:L/PR:N/UI:R/S:U, C/I/A all High) can redirect control flow and give the attacker code execution in the context of the process parsing the file. The CPE entry cpe:2.3:a:libbiosig_project:libbiosig:*:*:*:*:*:*:*:* leaves the version range unpinned, so downstream applications bundling a 3.9.1-era libbiosig inherit the flaw. Note the divergence between the NVD vector (AV:N/AC:L/PR:N/UI:N, 9.8) and the authoritative assessment (AV:L/UI:R, no privileges required): the underlying defect is a file-format parsing bug, not a remotely reachable service endpoint, and the practical constraint is delivering a malicious MFER file into a parsing workflow.
Know when Libbiosig gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
File-parsing flaw requiring a victim to open/process a crafted MFER file, so AV:L and UI:R rather than the input's AV:N/UI:N; full C/I/A impact from arbitrary code execution.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 65
Executive ViewAI
The Biosig Project libbiosig 3.9.1 contains a critical arbitrary code execution vulnerability triggered by a crafted MFER biosignal file, potentially allowing code execution under the victim application's privileges. Organizations that ingest untrusted MFER files into libbiosig-based workflows are most at risk; publicly available exploit code exists, and the vulnerability is not listed in CISA KEV. No vendor-released patch identified at time of analysis, so leadership should prioritize identifying affected deployments and applying interim mitigations.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict ingestion of untrusted MFER files, disable MFER parsing where not required, run libbiosig 3.9.1 in a sandboxed low-privilege environment, validate or reject untrusted file inputs, and monitor vendor advisories for a patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Arbitrary code execution can be achieved in The Biosig Project libbiosig 3.9.1 by supplying a crafted MFER file whose re
Arbitrary code execution in The Biosig Project libbiosig 3.9.1 occurs when the MFER parser processes a crafted MFER bios
A stack-based buffer overflow in The Biosig Project's libbiosig 3.9.1 allows memory corruption that can lead to arbitrar
Arbitrary code execution in The Biosig Project libbiosig 3.9.1 stems from stack-based buffer overflows in the MFER parsi
Stack-based buffer overflow in libbiosig 3.9.1's MFER parser allows arbitrary code execution when a crafted MFER file wi
An integer overflow vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.0 and Mast
Heap overflow in libbiosig 3.9.2 Intan CLP parsing. PoC available.
A double-free vulnerability exists in the BrainVision ASCII Header Parsing functionality of The Biosig Project libbiosig
An out-of-bounds write vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0
An integer underflow vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 an
A use-after-free vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Ma
An out-of-bounds write vulnerability exists in the BrainVisionMarker Parsing functionality of The Biosig Project libbios
GitHub PoC
Exploit-DB