libbiosig
CVE-2025-66046
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted MFER file to victim
-
DeliveryVictim application parses file via libbiosig
-
ExploitTag 67 triggers stack buffer overflow
-
ExecutionOverwrite return address/stack
-
ImpactExecute arbitrary code in app context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that an application built on libbiosig 3.9.1 parse an attacker-supplied MFER file whose Tag 67 field is maliciously crafted to overflow a stack buffer. The limiting factor is file delivery and processing: a victim (user or automated pipeline) must actually open/ingest the untrusted MFER file, so exploitation depends on the attacker getting the crafted file into a parsing workflow. There is no network-service component - the library does not listen on a port - so despite the AV:N in the supplied vector, exploitation is gated on untrusted-file handling rather than direct remote reachability. Deployment is further limited to environments that specifically use libbiosig for biosignal data. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores this 9.8 Critical, implying remote unauthenticated code execution with no user interaction. However, this is a file-parsing vulnerability in a library: the description states 'An attacker can provide a malicious file to trigger these vulnerabilities,' which inherently requires a victim to open or process a crafted MFER file. The vector's UI:N is therefore questionable - realistic exploitation requires user interaction (UI:R) and arguably local vector (AV:L), so the 9.8 overstates real-world ease of exploitation. Supporting signals are mixed: a public exploit/proof-of-concept exists (Talos report TALOS-2025-2296), which is credible given Cisco Talos is the reporting CNA, but EPSS is only 0.55% (44th percentile), indicating low observed/predicted mass-exploitation likelihood. This CVE is NOT in CISA KEV - no evidence of active exploitation. Net: a technically high-impact memory-corruption bug (stack-based overflow, CWE-121) in a niche biosignal library with confirmed POC but no active exploitation and limited deployment footprint. Priority should be driven by whether libbiosig 3.9.1 is actually in use and exposed to untrusted MFER files, not by the raw 9.8 score. No SSVC decision data was supplied in the input. |
| Exploit ScenarioDerived | An attacker crafts a malicious MFER file containing a specially constructed Tag 67 structure that overflows a stack buffer in libbiosig's MFER parser, then delivers it to a victim (e.g., via email, a shared dataset, or a medical-data upload) running an application that uses libbiosig 3.9.1. When the victim's software parses the file, the overflow overwrites stack memory and leads to arbitrary code execution in the context of that application. A public proof-of-concept is available via Cisco Talos. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Arbitrary code execution in The Biosig Project libbiosig 3.9.1 stems from stack-based buffer overflows in the MFER parsing functionality when Tag 67 is specially crafted; an attacker who can deliver a malicious MFER file to an application using the library can overwrite the stack and potentially execute code. Publicly available exploit code exists, but exploitation requires user interaction (the victim must open or ingest the crafted file) and is limited to deployments that process untrusted biosignal data, as the library does not expose a network service. EPSS is 0.55% (percentile 44%), indicating low predicted exploitation activity; no KEV listing is present.
RemediationAI
No vendor-released patch identified at time of analysis. Check the libbiosig project repository and The Biosig Project website for updates. As compensating controls, avoid processing untrusted MFER files with libbiosig; if MFER support is not required, disable or remove the MFER parsing code path (trade-off: loss of functionality for that format). Run libbiosig-based applications in a sandboxed environment with minimal privileges and restricted filesystem access (trade-off: performance overhead and potential compatibility issues). Implement strict file validation and allow-listing before parsing (trade-off: may reject legitimate files). Since exploitation requires user interaction, train users not to open untrusted MFER files and enforce email/web download policies. Monitor the Talos advisory page for updated guidance.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a stack-based buffer overflow (CWE-121) in the MFER (Medical waveform Format Encoding Rules) parser of libbiosig, a library for reading and writing biosignal data. When parsing an MFER file, the code handles Tag 67 without proper bounds checking on a stack-allocated buffer, allowing an attacker-controlled length or data to overflow adjacent memory. The CPE cpe:2.3:a:libbiosig_project:libbiosig:*:*:*:*:*:*:*:* indicates that all versions of the libbiosig project are potentially affected, with 3.9.1 confirmed by the advisory. Exploitation relies on the application calling the vulnerable parsing routine on an untrusted file; there is no network listener component.
Know when Libbiosig gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
File-parsing flaw requiring a victim to process a crafted MFER file, so AV:L and UI:R rather than the input's AV:N/UI:N; code execution yields full C:H/I:H/A:H.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 67
Executive ViewAI
The Biosig Project libbiosig 3.9.1 contains a critical stack-based buffer overflow in MFER parsing that can lead to arbitrary code execution when a user opens a malicious biosignal file. While publicly available exploit code exists, exploitation requires user interaction and is limited to deployments that process untrusted biosignal data, with no vendor-released patch identified at time of analysis. Leadership should prioritize identifying affected applications and limiting ingestion of untrusted files until a fix is available.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting MFER file ingestion to trusted sources, disabling MFER parsing if not required, running affected applications with least privilege in a sandboxed environment, enforcing file type allowlisting, monitoring for crashes or anomalous behavior, and segregating biosignal processing from sensitive systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Arbitrary code execution can be achieved in The Biosig Project libbiosig 3.9.1 by supplying a crafted MFER file whose re
Arbitrary code execution in The Biosig Project libbiosig 3.9.1 occurs when the MFER parser processes a crafted MFER bios
A stack-based buffer overflow in The Biosig Project's libbiosig 3.9.1 allows memory corruption that can lead to arbitrar
Arbitrary code execution in The Biosig Project libbiosig 3.9.1, where a specially crafted MFER biosignal file triggers a
Stack-based buffer overflow in libbiosig 3.9.1's MFER parser allows arbitrary code execution when a crafted MFER file wi
An integer overflow vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.0 and Mast
Heap overflow in libbiosig 3.9.2 Intan CLP parsing. PoC available.
A double-free vulnerability exists in the BrainVision ASCII Header Parsing functionality of The Biosig Project libbiosig
An out-of-bounds write vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0
An integer underflow vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 an
A use-after-free vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Ma
An out-of-bounds write vulnerability exists in the BrainVisionMarker Parsing functionality of The Biosig Project libbios
GitHub PoC
Exploit-DB