libbiosig CVE-2025-66047

Exploitation requires the target application to parse an attacker-supplied MFER (Medical waveform Format Encoding Rules) file using libbiosig 3.9.1, specifically a file containing Tag value 131 that drives the vulnerable MFER parsing path. The key limiting factor is file delivery and processing: the attacker must get the victim or an automated pipeline to open/ingest the malicious file, so exposure is confined to systems and services that actually accept and parse MFER input via this library. There are no special configuration prerequisites noted beyond use of the vulnerable version, but the dependence on victim-side file processing meaningfully constrains real-world reach despite the high impact.

The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) rates this as critical with unauthenticated network exploitation, but this signal conflicts with the description, which states 'An attacker can provide a malicious file to trigger these vulnerabilities' - a file-parsing flaw in a library almost always requires the victim to process an attacker-supplied MFER file, implying user interaction (UI:R) and often a local/file delivery vector rather than true AV:N/UI:N. This CVSS-vs-description conflict should be verified with the vendor/Talos. The supporting signals lower the real-world urgency: EPSS is only 0.55% (44th percentile), the CVE is NOT on CISA KEV, and there is no SSVC decision record provided. A POC/exploit is publicly available (Talos report TALOS-2025-2296), which raises the exploitation feasibility relative to EPSS, but POC availability is not the same as active exploitation - no active exploitation is confirmed. Net: this is a technically high-impact (code execution) bug in a niche biosignal library, but the practical risk is moderate because exploitation hinges on getting a target to parse a malicious file and the product footprint is small - it is a genuine 'high-CVSS, lower-real-world-risk' case rather than an urgent widespread emergency.

An attacker crafts a malicious MFER file with a Tag value of 131 that overflows a stack buffer in libbiosig 3.9.1's MFER parser, then delivers it to a victim (e.g., via an upload portal, email, or a research pipeline that auto-ingests biosignal files). When the application using libbiosig parses the file, the overflow overwrites the stack and leads to arbitrary code execution in the context of the parsing process. Public exploit/POC details are available via the Talos vulnerability report, lowering the barrier to weaponization.