libbiosig CVE-2025-66048

Exploitation requires a victim application or workflow using libbiosig 3.9.1 to parse an attacker-supplied MFER (Medical waveform Format Encoding Rules) file whose record contains the specific Tag value 133, which triggers the stack-based overflow in the MFER parsing routine. LIMITING FACTORS: exploitation is not self-propagating - it depends on the target opening/processing an untrusted MFER file, so delivery and victim action are prerequisites; it is confined to environments that actually ingest MFER-format biosignal data with libbiosig 3.9.1, a specialized use case. No special product configuration setting is named as required, but the attack is only relevant where MFER file parsing is exposed to untrusted input.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) yields a 9.8 'critical' score, but these signals conflict with the description and should be weighed critically. The description states an attacker must 'provide a malicious file' that libbiosig then parses - this is a classic client-side file-parsing flaw, which realistically requires the victim's application to open/process the crafted MFER file (user interaction), contradicting the UI:N in the published vector. Talos-sourced POC/exploit code is publicly available, confirming the overflow is reachable and reliable, but the EPSS score is low (0.71%, 52th percentile) and the CVE is NOT on CISA KEV, indicating no evidence of widespread or active exploitation. Net assessment: a technically serious, exploitable RCE (publicly available exploit code exists), but real-world priority is tempered by (a) the niche footprint of libbiosig and (b) the practical requirement that a victim open an attacker-supplied file. Treat the raw 9.8 as inflated for most environments - the effective risk is closer to a high-severity user-interaction RCE confined to systems that process untrusted MFER biosignal files. Verify the attack vector with the vendor/Talos report, since AV:N/UI:N likely overstates remote, no-interaction exploitability.

An attacker crafts a malicious MFER biosignal file containing a malformed Tag 133 structure and delivers it to a victim (e.g., via email, a clinical data exchange, or a shared research dataset). When an application built on libbiosig 3.9.1 parses the file, the stack-based buffer overflow is triggered, allowing arbitrary code execution in the context of the parsing process. Publicly available exploit code from Talos (TALOS-2025-2296) demonstrates the condition, lowering the barrier to weaponization.